diff options
| author | Manoj Prabhu B <bmanoj@codeaurora.org> | 2021-04-15 16:23:09 +0530 |
|---|---|---|
| committer | Jairaj Solanki <quic_jsolanki@quicinc.com> | 2022-09-19 19:23:09 +0530 |
| commit | e41c0da23b38b2458c3b3f3e7d22b13e440d4719 (patch) | |
| tree | 67bfdc27ba443ca6f0c6a732c6680c3aa64a059c | |
| parent | 16802e80ecb58bd39ce55d2f29457455735b650e (diff) | |
diag: Prevent out of bound write while sending dci pkt to remote
Sanitize user input length for the maximum buffer size before
writing the dci packet to remote.
Change-Id: I1f813a969fcce589f9e5024864ef4a650f2cf64e
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
| -rw-r--r-- | drivers/char/diag/diag_dci.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index 1fe7fa0debcc..20c9a0ecb68f 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -1734,7 +1734,16 @@ static int diag_send_dci_pkt_remote(unsigned char *data, int len, int tag, write_len += dci_header_size; *(int *)(buf + write_len) = tag; write_len += sizeof(int); - memcpy(buf + write_len, data, len); + if ((write_len + len) < DIAG_MDM_BUF_SIZE) { + memcpy(buf + write_len, data, len); + } else { + pr_err("diag: skip writing invalid length packet, token: %d, pkt_len: %d\n", + token, (write_len + len)); + spin_lock_irqsave(&driver->dci_mempool_lock, flags); + diagmem_free(driver, buf, dci_ops_tbl[token].mempool); + spin_unlock_irqrestore(&driver->dci_mempool_lock, flags); + return -EAGAIN; + } write_len += len; *(buf + write_len) = CONTROL_CHAR; /* End Terminator */ write_len += sizeof(uint8_t); |