diag: Fix feature mask received check
Currently, there is an array index out of bounds condition when
checking if the feature mask has been received from a peripheral
yet. Fix the check to prevent array index out of bounds.
CRs-Fixed: 564309
Change-Id: I38ea1584cdd3121c0981c247fe9ded37881b7f7a
Signed-off-by: Dixon Peterson <dixonp@codeaurora.org>
diff --git a/drivers/char/diag/diagfwd.c b/drivers/char/diag/diagfwd.c
index 1a7b2f8..54e4696 100644
--- a/drivers/char/diag/diagfwd.c
+++ b/drivers/char/diag/diagfwd.c
@@ -1051,9 +1051,10 @@
return is_mode_reset;
}
-void diag_send_data(struct diag_master_table entry, unsigned char *buf,
+int diag_send_data(struct diag_master_table entry, unsigned char *buf,
int len, int type)
{
+ int success = 1;
driver->pkt_length = len;
/* If the process_id corresponds to an apps process */
@@ -1069,13 +1070,19 @@
if (entry.client_id < NUM_SMD_DATA_CHANNELS) {
struct diag_smd_info *smd_info;
int index = entry.client_id;
+ if (!driver->rcvd_feature_mask[
+ entry.client_id]) {
+ pr_debug("diag: In %s, feature mask for peripheral: %d not received yet\n",
+ __func__, entry.client_id);
+ return 0;
+ }
/*
* Mode reset should work even if
* modem is down
*/
if ((index == MODEM_DATA) &&
diag_check_mode_reset(buf)) {
- return;
+ return 1;
}
smd_info = (driver->separate_cmdrsp[index] &&
index < NUM_SMD_CMD_CHANNELS) ?
@@ -1095,9 +1102,12 @@
} else {
pr_alert("diag: In %s, incorrect channel: %d",
__func__, entry.client_id);
+ success = 0;
}
}
}
+
+ return success;
}
void diag_process_stm_mask(uint8_t cmd, uint8_t data_mask, int data_type,
@@ -1191,6 +1201,7 @@
unsigned char *temp = buf;
int data_type;
int mask_ret;
+ int status = 0;
#if defined(CONFIG_DIAG_OVER_USB)
unsigned char *ptr;
#endif
@@ -1217,14 +1228,15 @@
pr_debug("diag: %d %d %d", cmd_code, subsys_id, subsys_cmd_code);
for (i = 0; i < diag_max_reg; i++) {
entry = driver->table[i];
- if (entry.process_id != NO_PROCESS &&
- driver->rcvd_feature_mask[entry.client_id]) {
+ if (entry.process_id != NO_PROCESS) {
if (entry.cmd_code == cmd_code && entry.subsys_id ==
subsys_id && entry.cmd_code_lo <=
subsys_cmd_code &&
entry.cmd_code_hi >= subsys_cmd_code) {
- diag_send_data(entry, buf, len, data_type);
- packet_type = 0;
+ status = diag_send_data(entry, buf, len,
+ data_type);
+ if (status)
+ packet_type = 0;
} else if (entry.cmd_code == 255
&& cmd_code == 75) {
if (entry.subsys_id ==
@@ -1233,9 +1245,10 @@
subsys_cmd_code &&
entry.cmd_code_hi >=
subsys_cmd_code) {
- diag_send_data(entry, buf, len,
- data_type);
- packet_type = 0;
+ status = diag_send_data(entry, buf,
+ len, data_type);
+ if (status)
+ packet_type = 0;
}
} else if (entry.cmd_code == 255 &&
entry.subsys_id == 255) {
@@ -1243,9 +1256,10 @@
cmd_code &&
entry.
cmd_code_hi >= cmd_code) {
- diag_send_data(entry, buf, len,
+ status = diag_send_data(entry, buf, len,
data_type);
- packet_type = 0;
+ if (status)
+ packet_type = 0;
}
}
}