Commit graph

25 commits

Author SHA1 Message Date
Manoj Prabhu B
96eca37071 diag: Check command size against the minimum before parsing
Add check for minimum length before typecasting to build mask
structure to prevent out of bound access while processing
get msg mask command.

CRs-Fixed: 2431047
Change-Id: I5b8341f278b0b46359800e43c604c5671261c728
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2019-05-30 02:04:29 -07:00
Hardik Arya
c3852a5d61 diag: Mark Buffer as NULL after freeing
There is a possibility of use-after-free and
double free because of not marking buffer as
NULL after freeing. The patch marks buffer
as NULL after freeing in error case.

Change-Id: Iacf8f8a4a4e644f48c87d5445ccd594766f2e156
Signed-off-by: Hardik Arya <harya@codeaurora.org>
2018-12-19 01:31:51 -08:00
Manoj Prabhu B
3977c31dd3 diag: Prevent out of bound access while initializing msg mask
Move the mask_info mutex initialization outside mask structure
to facilitate prevention of out of bound access while initializing
msg mask during md session creation. Use separate msg_mask_tbl_count
for ODL session msg mask and regular msg mask to prevent out of
bound access in a possible race condition of accessing mask ranges.

Change-Id: I87497c67daff8cc1797a1266d50456bdbd3a9c23
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2018-08-27 14:58:54 +05:30
Manoj Prabhu B
0b3dc1a93e diag: Add NULL checks for the mask and mask pointer
The chances of accessing uninitialized mask is prevented
by adding null pointer checks for the mask structure and its
member pointer.

Change-Id: Ibf0467228794b773fc2537d34f1da6719bbb975a
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2018-08-09 21:59:04 -07:00
Hardik Arya
280b89e72c diag: Add missing protection while accessing session's info
Currently, mutex protection is missing while accessing md session's
info via macro. The patch adds proper protection before accessing
the same.

Change-Id: I17b18183407279447229783fd0165337bd173423
Signed-off-by: Hardik Arya <harya@codeaurora.org>
2018-08-07 17:54:41 +05:30
Manoj Prabhu B
0fe549f6b6 diag: Update mask buffer after reallocation
Currently, reallocated mask update buffers are not
updated if the received mask range is more than the
mask update buffer length. Update the reallocated buffer
address before writing the mask to peripherals.

CRs-Fixed: 2266693
Change-Id: I6b506ce68e17b7da61926b0f9543157812a8c555
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2018-07-04 23:11:14 -07:00
Mohit Aggarwal
af0b8ef27c diag: Update mask pointers after reallocation
Currently, mask pointers are not updated in
case peripherals are supporting more mask
tables. The patch updates the mask pointers
properly.

Change-Id: I1360c722076fca0215e0ccd28247c4741a1ebd88
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2018-07-02 01:49:57 -07:00
Hardik Arya
808955b188 diag: Fix possible use-after-free issue for mdlog session info
Currently there is a possibility of accessing freed mdlog
session info and it's attributes after closing the session.
The patch adds protection while accessing mdlog session info
for preventing use-after-free issue.

CRs-Fixed: 2133028
Change-Id: Iba603bc2d75f84a604df2627e8fcb2a18acf4637
Signed-off-by: Hardik Arya <harya@codeaurora.org>
2018-02-02 14:39:22 +05:30
Hardik Arya
15a9d5118c diag: Add NULL pointer checks for mask info
Currently there is a possibility of NULL pointer
dereference issue due to NULL pointers checks are
missing for mask info. The patch fixes the issue by
adding NULL pointer checks.

CRs-Fixed: 2108911
Change-Id: I097aeacc90c8d88034bf799ee4e398ddda5e23f1
Signed-off-by: Hardik Arya <harya@codeaurora.org>
2017-09-14 11:53:53 +05:30
Manoj Prabhu B
6e6b233c47 diag: Synchronize msg mask read and write on a peripheral
The patch synchronizes msg mask read and write on a peripheral
by proper protection of mask_info and msg_mask_table_count.

CRs-Fixed: 2042362, 2055291
Change-Id: If136012855834b0b8cba91eb66bf711750e8f372
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2017-07-19 20:51:10 +05:30
Mohit Aggarwal
ccab495a2f diag: Protect mask updates for memory device session
Currently, there is a possibility of using already freed
memory device session members during mask updates. The
patch fixes the issue by adding proper protection.

CRs-Fixed: 2074264
Change-Id: Iff2009a498506ffe574655badfe0a0f9f0dece9a
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
2017-07-12 10:12:55 +05:30
Chris Lew
a56ba7b5ce diag: Update msg mask tables for new SSID
Update the diag headers and msg mask tables to account
for a new ssid group.

CRs-Fixed: 2055789
Change-Id: I3abd816d5e99bff263b753fb1070a2672ecea46c
Signed-off-by: Chris Lew <clew@codeaurora.org>
2017-06-19 16:19:18 -07:00
Mohit Aggarwal
7687d76d92 diag: Enable masks for user pd memory device session
Currently, masks are not getting enabled on peripherals
when launching user pd memory device session. The patch
takes care to enable the masks properly.

CRs-Fixed: 2051486
Change-Id: I8aa38310f5ec20a41aa0a0e123033d6c8cb38d48
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
2017-05-24 15:14:26 +05:30
Gopikrishna Mogasati
f09aee50c2 diag: Add proper synchronization checks to msg mask table
This fix removes dependency between real time message mask
table and build time message mask table. Also this fix
synchronizes retrieval and modification of real time message
mask table.

CRs-Fixed: 2015227
Change-Id: Id0a0964337ec4645d7061fc35120dfa061a990ff
Signed-off-by: Gopikrishna Mogasati <gmogas@codeaurora.org>
2017-05-06 14:00:10 +05:30
Manoj Prabhu B
dc5e63d935 diag: Split data stream for User PDs on LPASS
This patch segregates different PD data onto separate buffers
and then onto its own data stream.

CRs-Fixed: 2019189
Change-Id: I09c4e1a7da0ccd3ba3e025e9f13da0fbcb95f103
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2017-04-20 20:52:49 +05:30
Manoj Prabhu B
67d53d08d8 diag: Fix feature mask mismatch for peripherals
This patch adds a way to publish APPS support
of untagging header only to selected peripherals.

CRs-Fixed: 2030651
Change-Id: I2a2a03d0a6d441d23ec093ff5de9bef5e9799d24
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2017-04-09 20:34:46 +05:30
Manoj Prabhu B
db3fd8b4be diag: Add support for header untagging
This patch provides the support for segregate different PD data onto
separate buffers and then onto its own data stream based on received
diag private id header from the peripheral data packets.
This patch adds a new feature mask supporting the feature and
a new IOCTL querying the support of the feature.

CRs-Fixed: 1112307
Change-Id: Id76e718f83e09defc221f9ee169d4676d8e57d8a
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2017-03-25 22:02:40 +05:30
Mohit Aggarwal
b8cd1fca02 diag: Add NULL pointer checks in mask updates
Currently, NULL pointer checks are missing in mask
update functions which might lead to NULL pointer
dereference issues. This patch fixes the issue by
adding appropriate checks.

CRs-Fixed: 2015104
Change-Id: I9df99208e283c8d90921c6e20a6a80f88c18a327
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
2017-03-06 11:52:50 +05:30
Manoj Prabhu B
9ce38e70a0 diag: Clear masks upon logging exit
This patch clears the peripheral masks upon the mdlog exit
and USB disconnection. This enables to keep the data and
cmd channel open for read.

CRs-Fixed: 1057143
Change-Id: Ie6f19319b75f3bf389ddd5a8168fd3bcd3efbc8b
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2016-09-08 23:56:37 -07:00
Manoj Prabhu B
2da25adb21 diag: Fix for possible memory corruption
When peripheral supporting more ssids than apps
in a given table entry needs reallocation.
No reallocation causes slab-out-of-bounds reads seen as
bad access/memory corruption.
This patch fixes memory availability limitation.

KASAN Report
27.044086:<6> ===========================================================
27.044108:<6> BUG: KASAN: slab-out-of-bounds in
diag_cntl_process_read_data+0xeb0/0x10d4 at addr 0xffffffc033997e6c
27.044112:<6> Read of size 4 by task kworker/u8:9/671
27.044117:<6> ===========================================================
27.044123:<6> BUG kmalloc-128 (Tainted: G B W):kasan: bad access detected
27.044126:<6> -----------------------------------------------------------
27.044136:<6> INFO: Allocated in d
	iag_create_msg_mask_table_entry+0x10c/0x148 age=1444 cpu=3 pid=1
27.044147:<6> alloc_debug_processing+0x118/0x170
27.044153:<6> __slab_alloc.isra.20.constprop.22+0x2a4/0x3a0
27.044159:<6> __kmalloc+0xe8/0x27c
27.044165:<6> diag_create_msg_mask_table_entry+0x108/0x148
27.044170:<6> diag_masks_init+0x30c/0xa1c
27.044184:<6> diagchar_init+0x624/0xa4c
27.044190:<6> do_one_initcall+0x250/0x278
27.044198:<6> kernel_init_freeable+0x1c4/0x268
27.044207:<6> kernel_init+0x10/0xd8
27.044212:<6> ret_from_fork+0xc/0x30
27.044219:<6> INFO: Slab 0xffffffba47b79720 objects=16 used=16 fp=0x
	(null) flags=0x4080
27.044224:<6> INFO: Object 0xffffffc033997e00 @offset=7680
	fp=0xffffffc033997c00
27.044232:<6> Bytes b4 0xffffffc033997df0: 5a 5a 5a 5a 5a 5a 5a 5a 5a
	5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
27.044238:<6> Object 0xffffffc033997e00: 1f 00 00 00 1f 00 00 00 1f
	00 00 00 1f 00 00 00  ................
27.044244:<6> Object 0xffffffc033997e10: 1f 00 00 00 1f 00 00 00 1f
	00 00 00 1f 00 00 00  ................
27.044249:<6> Object 0xffffffc033997e20: 1f 00 00 00 1f 00 00 00 1f
	00 00 00 1f 00 00 00  ................
27.044255:<6> Object 0xffffffc033997e30: 1f 00 00 00 1f 00 00 00 1f
	00 00 00 1f 00 00 00  ................
27.044260:<6> Object 0xffffffc033997e40: 1f 00 00 00 1f 00 00 00 1f
	00 00 00 1f 00 00 00  ................
27.044266:<6> Object 0xffffffc033997e50: 1f 00 00 00 1f 00 00 00 1f
	00 00 00 1f 00 00 00  ................
27.044271:<6> Object 0xffffffc033997e60: 1f 00 00 00 1f 00 00 00 1f
	00 00 00 00 00 00 00  ................
27.044277:<6> Object 0xffffffc033997e70: 00 00 00 00 00 00 00 00 00
	00 00 00 00 00 00 00  ................
27.044283:<6> Redzone 0xffffffc033997e80: cc cc cc cc cc cc cc cc
                      ........
27.044288:<6> Padding 0xffffffc033997fc0: 5a 5a 5a 5a 5a 5a 5a 5a
	5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
27.044294:<6> Padding 0xffffffc033997fd0: 5a 5a 5a 5a 5a 5a 5a 5a
	5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
27.044299:<6> Padding 0xffffffc033997fe0: 5a 5a 5a 5a 5a 5a 5a 5a
	5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
27.044305:<6> Padding 0xffffffc033997ff0: 5a 5a 5a 5a 5a 5a 5a 5a
	5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
27.044315:<6> CPU: 1 PID: 671 Comm: kworker/u8:9
	Tainted: G    B   W  3.18.20-g2c703ee #2
27.044319:<6> Hardware name: Qualcomm Technologies, Inc.
	MSM 8996 v3.0 + PMI8994 MTP (DT)
27.044332:<2> Workqueue: DIAG_SOCKMODEM_CNTL socket_read_work_fn
27.044335:<6> Call trace:
27.044343:<2> [<ffffffc00008a168>] dump_backtrace+0x0/0x1c4
27.044350:<2> [<ffffffc00008a33c>] show_stack+0x10/0x1c
27.044359:<2> [<ffffffc00129a850>] dump_stack+0x74/0xc8
27.044366:<2> [<ffffffc000213d8c>] print_trailer+0x19c/0x1b0
27.044372:<2> [<ffffffc000214788>] object_err+0x3c/0x50
27.044378:<2> [<ffffffc000219918>] kasan_report+0x34c/0x504
27.044385:<2> [<ffffffc000218928>] __asan_load4+0x20/0x74
27.044392:<2>[<ffffffc0006f1594>] diag_cntl_process_read_data+0xeac/0x10d4
27.044399:<2> [<ffffffc0006e67f0>] diagfwd_cntl_read_done+0x78/0xf0
27.044407:<2> [<ffffffc0006e7b38>] diagfwd_channel_read_done+0x154/0x184
27.044414:<2> [<ffffffc0006ebdd4>] diag_socket_read+0x480/0x534
27.044420:<2> [<ffffffc0006e85cc>] diagfwd_channel_read+0x348/0x368
27.044427:<2> [<ffffffc0006eabc4>] socket_read_work_fn+0x20/0x30
27.044437:<2> [<ffffffc0000cabf8>] process_one_work+0x394/0x64c
27.044444:<2> [<ffffffc0000cbfb8>] worker_thread+0x3bc/0x550
27.044450:<2> [<ffffffc0000d256c>] kthread+0x180/0x194
27.044753:<6> coresight-tmc 3028000.tmc: TMC aborted
27.044765:<6> Kernel panic - not syncing: kasan: bad access detected

CRs-Fixed: 993725
Change-Id: I90a6a560900d6c1c3694cce460ae8f772dc3434e
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2016-05-27 14:54:21 -07:00
Manoj Prabhu B
34ef12d7fe diag: Fix possible kernel addresses leak
This patch addresses kernel addresses leak by changing
the format specifier to adhere to the kptr_restrict system setting.

CRs-Fixed: 987013
Change-Id: I32649a26f54d96c56d80aa2a1bd5f5d9dd0dd9d3
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2016-05-19 16:10:45 -07:00
Chris Lew
640db7a76d diag: Add support for extended header over dci
Add handling for extended header packets going
to the DCI stream. Set new bit in feature mask
to signal support for extended headers over DCI.

CRs-Fixed: 998973
Change-Id: I8badb0aa9e6ff604d8d0b2a932df0ea5ef6a70f9
Signed-off-by: Chris Lew <clew@codeaurora.org>
2016-04-27 19:04:59 -07:00
Manoj Prabhu B
97ea6d4a52 diag: Fix possible mask pointer corruption
This patch updates the stale pointer corrupted at
specific ssid ranges.
This patch also addresses wrong range tools value
updation.

CRs-Fixed: 980487
Change-Id: I2b8afcef25dceb76118b803c67f4c5656feae82b
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2016-03-25 16:03:08 -07:00
Chris Lew
26d8c657ca diag: Change to update the range correctly on a range mismatch
Setting message masks with tools outside of the initial range
causes a reallocation of the structure with the wrong size.
This change updates the sizes to the correct values.

Change-Id: I8bb0d0b77cd4d2417b10345b6e4b09ff29ba5f8c
Signed-off-by: Christopher Lew <clew@codeaurora.org>
2016-03-23 21:18:16 -07:00
Sreelakshmi Gownipalli
fc116784df diag: Add snap shot of diag driver
Add snap shot of diag driver

Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
2016-03-23 19:58:26 -07:00