Skip to content
This repository was archived by the owner on Jul 3, 2018. It is now read-only.

Commit 080f4cf

Browse files
Mohit AggarwalGerrit - the friendly Code Review server
authored andcommitted
diag: Synchronize command registration table access
Currently, command registration table is being read in debugfs without any protection which may lead to access of stale entries. The patch takes care of the issue by adding proper protection. CRs-Fixed: 2032672 Change-Id: I6ae058c16873f9ed52ae6516a1a70fd6d2d0da80 Signed-off-by: Mohit Aggarwal <[email protected]>
1 parent f2a4824 commit 080f4cf

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

drivers/char/diag/diag_debugfs.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
1+
/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
22
*
33
* This program is free software; you can redistribute it and/or modify
44
* it under the terms of the GNU General Public License version 2 and
@@ -256,8 +256,10 @@ static ssize_t diag_dbgfs_read_table(struct file *file, char __user *ubuf,
256256
struct list_head *temp;
257257
struct diag_cmd_reg_t *item = NULL;
258258

259+
mutex_lock(&driver->cmd_reg_mutex);
259260
if (diag_dbgfs_table_index == driver->cmd_reg_count) {
260261
diag_dbgfs_table_index = 0;
262+
mutex_unlock(&driver->cmd_reg_mutex);
261263
return 0;
262264
}
263265

@@ -266,6 +268,7 @@ static ssize_t diag_dbgfs_read_table(struct file *file, char __user *ubuf,
266268
buf = kzalloc(sizeof(char) * buf_size, GFP_KERNEL);
267269
if (ZERO_OR_NULL_PTR(buf)) {
268270
pr_err("diag: %s, Error allocating memory\n", __func__);
271+
mutex_unlock(&driver->cmd_reg_mutex);
269272
return -ENOMEM;
270273
}
271274
buf_size = ksize(buf);
@@ -310,6 +313,7 @@ static ssize_t diag_dbgfs_read_table(struct file *file, char __user *ubuf,
310313
break;
311314
}
312315
diag_dbgfs_table_index = i;
316+
mutex_unlock(&driver->cmd_reg_mutex);
313317

314318
*ppos = 0;
315319
ret = simple_read_from_buffer(ubuf, count, ppos, buf, bytes_in_buffer);

0 commit comments

Comments
 (0)