evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

diag: Prevent out-of-bound access while processing non-hdlc pkt

Browse source 
While parsing non-hdlc packet buffer length passed to hdlc
recovery is not updated after parsing partial packet, Which
can lead to out-of-bound access. The patch passes the updated
buffer length for the same.

Change-Id: I5596f8c5a72680684c9c9056dccaf33e3c36832c
Signed-off-by: Hardik Arya <harya@codeaurora.org>
This commit is contained in:
Hardik Arya 2019-04-22 14:22:08 +05:30 • committed by Gerrit - the friendly Code Review server
parent 5c004decb3
commit f275209c75
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/char/diag/diagfwd.c
View file

@ -1648,7 +1648,7 @@ void diag_process_non_hdlc_pkt(unsigned char *buf, int len, int pid)
if (*(uint8_t *)(data_ptr + actual_pkt->length) !=
CONTROL_CHAR) {
mutex_unlock(&driver->hdlc_recovery_mutex);
diag_hdlc_start_recovery(buf, len, pid);
diag_hdlc_start_recovery(buf, (len - read_bytes), pid);
mutex_lock(&driver->hdlc_recovery_mutex);
}
err = diag_process_apps_pkt(data_ptr,
@ -1674,8 +1674,8 @@ start:
pkt_len = actual_pkt->length;
if (actual_pkt->start != CONTROL_CHAR) {
diag_hdlc_start_recovery(buf, len, pid);
diag_send_error_rsp(buf, len, pid);
diag_hdlc_start_recovery(buf, (len - read_bytes), pid);
diag_send_error_rsp(buf, (len - read_bytes), pid);
goto end;
}
mutex_lock(&driver->hdlc_recovery_mutex);
@ -1683,7 +1683,7 @@ start:
pr_err("diag: In %s, incoming data is too large for the request buffer %d\n",
__func__, pkt_len);
mutex_unlock(&driver->hdlc_recovery_mutex);
diag_hdlc_start_recovery(buf, len, pid);
diag_hdlc_start_recovery(buf, (len - read_bytes), pid);
break;
}
if ((pkt_len + header_len) > (len - read_bytes)) {
@ -1700,7 +1700,7 @@ start:
if (*(uint8_t *)(data_ptr + actual_pkt->length) !=
CONTROL_CHAR) {
mutex_unlock(&driver->hdlc_recovery_mutex);
diag_hdlc_start_recovery(buf, len, pid);
diag_hdlc_start_recovery(buf, (len - read_bytes), pid);
mutex_lock(&driver->hdlc_recovery_mutex);
}
else