diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-05-17 17:41:17 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-05-17 17:41:17 -0700 |
| commit | 1a19a7dd637c50dcd411c31ddd45af64f965ee92 (patch) | |
| tree | 7fb3db817dbbe7d54a5c64115c4cc35328ca4583 | |
| parent | 1eb0e6af4eb4aa3fe4b6e446bb425e7f8317b07a (diff) | |
| parent | 9430b8378d339691d0ba98dffeb0d9768fb10ce0 (diff) | |
Merge "diag: dci: Validate dci client entries prior read"LE.UM.2.3.7-13600-sda845.0LE.UM.2.3.7-13500-sda845.0
| -rw-r--r-- | drivers/char/diag/diag_dci.c | 4 | ||||
| -rw-r--r-- | drivers/char/diag/diagchar_core.c | 19 |
2 files changed, 18 insertions, 5 deletions
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index a089e7c552e2..0937b2f14d77 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -2303,8 +2303,8 @@ struct diag_dci_client_tbl *dci_lookup_client_entry_pid(int tgid) pid_struct = find_get_pid(entry->tgid); if (!pid_struct) { DIAG_LOG(DIAG_DEBUG_DCI, - "diag: valid pid doesn't exist for pid = %d\n", - entry->tgid); + "diag: Exited pid (%d) doesn't match dci client of pid (%d)\n", + tgid, entry->tgid); continue; } task_s = get_pid_task(pid_struct, PIDTYPE_PID); diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c index 01732bed3095..555e92474eee 100644 --- a/drivers/char/diag/diagchar_core.c +++ b/drivers/char/diag/diagchar_core.c @@ -552,8 +552,8 @@ static int diagchar_close(struct inode *inode, struct file *file) { int ret; - DIAG_LOG(DIAG_DEBUG_USERSPACE, "diag: process exit %s\n", - current->comm); + DIAG_LOG(DIAG_DEBUG_USERSPACE, "diag: %s process exit with pid = %d\n", + current->comm, current->tgid); ret = diag_remove_client_entry(file); return ret; @@ -3262,6 +3262,8 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count, int exit_stat = 0; int write_len = 0; struct diag_md_session_t *session_info = NULL; + struct pid *pid_struct = NULL; + struct task_struct *task_s = NULL; mutex_lock(&driver->diagchar_mutex); for (i = 0; i < driver->num_clients; i++) @@ -3506,8 +3508,19 @@ exit: list_for_each_safe(start, temp, &driver->dci_client_list) { entry = list_entry(start, struct diag_dci_client_tbl, track); - if (entry->client->tgid != current->tgid) + pid_struct = find_get_pid(entry->tgid); + if (!pid_struct) continue; + task_s = get_pid_task(pid_struct, PIDTYPE_PID); + if (!task_s) { + DIAG_LOG(DIAG_DEBUG_DCI, + "diag: valid task doesn't exist for pid = %d\n", + entry->tgid); + continue; + } + if (task_s == entry->client) + if (entry->client->tgid != current->tgid) + continue; if (!entry->in_service) continue; if (copy_to_user(buf + ret, &data_type, sizeof(int))) { |