A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Do not copy buffer to user-space if diag read fails

Browse source 
ATH diag procfs read is copying read_buffer to user space
unconditionally, causing kernel heap information leak of
uninitialized read_buffer if hif diag read fails.
Do not copy buffer to user space if diag read fails to
avoid information leak to user space.

Change-Id: I5e07cad4f90e5e9b3c461268b8fa3635c3128b9f
CRs-Fixed: 1104731
This commit is contained in:
Govind Singh 2017-02-03 11:12:30 +05:30 • committed by qcabuildsw
commit 23a1564da5
1 changed files with 4 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hif/src/ath_procfs.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
* Copyright (c) 2013-2014, 2016-2017 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@ -104,6 +104,8 @@ static ssize_t ath_procfs_diag_read(struct file *file, char __user *buf,
}
out:
if (rv)
return -EIO;
if (copy_to_user(buf, read_buffer, count)) {
qdf_mem_free(read_buffer);
@ -113,11 +115,7 @@ out:
} else
qdf_mem_free(read_buffer);
if (rv == 0) {
return count;
} else {
return -EIO;
}
return count;
}
static ssize_t ath_procfs_diag_write(struct file *file,