diag: Add mutex protection while reading dci debug statistics

Unserialized access to diag_dbgfs_dci_data_index can lead to
heap overflow. Add mutex protection while updating the
diag_dbgfs_dci_data_index.

Change-Id: Iee9d0447494e3576e6293afcd4d7611bc429aa8a
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>

diff --git a/drivers/char/diag/diag_debugfs.c b/drivers/char/diag/diag_debugfs.c
index c963e46..5e45587 100644 (file)
--- a/drivers/char/diag/diag_debugfs.c
+++ b/drivers/char/diag/diag_debugfs.c
@@ -52,7 +52,7 @@ static int diag_dbgfs_bridgeinfo_index;
 static int diag_dbgfs_finished;
 static int diag_dbgfs_dci_data_index;
 static int diag_dbgfs_dci_finished;
-
+static struct mutex diag_dci_dbgfs_mutex;
 static ssize_t diag_dbgfs_read_status(struct file *file, char __user *ubuf,
                                      size_t count, loff_t *ppos)
 {
@@ -159,6 +159,7 @@ static ssize_t diag_dbgfs_read_dcistats(struct file *file,
        buf_size = ksize(buf);
        bytes_remaining = buf_size;
 
+       mutex_lock(&diag_dci_dbgfs_mutex);
        if (diag_dbgfs_dci_data_index == 0) {
                bytes_written =
                        scnprintf(buf, buf_size,
@@ -214,8 +215,8 @@ static ssize_t diag_dbgfs_read_dcistats(struct file *file,
                }
                temp_data++;
        }
-
        diag_dbgfs_dci_data_index = (i >= DIAG_DCI_DEBUG_CNT) ? 0 : i + 1;
+       mutex_unlock(&diag_dci_dbgfs_mutex);
        bytes_written = simple_read_from_buffer(ubuf, count, ppos, buf,
                                                                bytes_in_buf);
        kfree(buf);
@@ -1186,6 +1187,7 @@ int diag_debugfs_init(void)
                pr_warn("diag: could not allocate memory for dci debug info\n");
 
        mutex_init(&dci_stat_mutex);
+       mutex_init(&diag_dci_dbgfs_mutex);
        return 0;
 err:
        kfree(dci_traffic);
@@ -1202,6 +1204,7 @@ void diag_debugfs_cleanup(void)
 
        kfree(dci_traffic);
        mutex_destroy(&dci_stat_mutex);
+       mutex_destroy(&diag_dci_dbgfs_mutex);
 }
 #else
 int diag_debugfs_init(void) { return 0; }