A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "msm: adsprpc: overflow vulnerability by race condition in adsprpc driver"

Browse source
This commit is contained in:
qctecmdr 2021-03-25 09:53:26 -07:00 • committed by Gerrit - the friendly Code Review server
commit 3382301014
1 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
drivers/char/adsprpc.c
View file

@ -5421,7 +5421,10 @@ static int fastrpc_set_process_info(struct fastrpc_file *fl)
{
int err = 0, buf_size = 0;
char strpid[PID_SIZE];
char cur_comm[TASK_COMM_LEN];
memcpy(cur_comm, current->comm, TASK_COMM_LEN);
cur_comm[TASK_COMM_LEN-1] = '\0';
fl->tgid = current->tgid;
/*
@ -5433,7 +5436,7 @@ static int fastrpc_set_process_info(struct fastrpc_file *fl)
fl->untrusted_process = true;
snprintf(strpid, PID_SIZE, "%d", current->pid);
if (debugfs_root) {
buf_size = strlen(current->comm) + strlen("_")
buf_size = strlen(cur_comm) + strlen("_")
+ strlen(strpid) + 1;
spin_lock(&fl->hlock);
@ -5449,13 +5452,13 @@ static int fastrpc_set_process_info(struct fastrpc_file *fl)
err = -ENOMEM;
return err;
}
snprintf(fl->debug_buf, UL_SIZE, "%.10s%s%d",
current->comm, "_", current->pid);
snprintf(fl->debug_buf, buf_size, "%.10s%s%d",
cur_comm, "_", current->pid);
fl->debugfs_file = debugfs_create_file(fl->debug_buf, 0644,
debugfs_root, fl, &debugfs_fops);
if (IS_ERR_OR_NULL(fl->debugfs_file)) {
pr_warn("Error: %s: %s: failed to create debugfs file %s\n",
current->comm, __func__, fl->debug_buf);
cur_comm, __func__, fl->debug_buf);
fl->debugfs_file = NULL;
kfree(fl->debug_buf);
fl->debug_buf = NULL;