From 0d5800910f4bf28fe79de41806bc446f22954527 Mon Sep 17 00:00:00 2001 From: Michael Adisumarta Date: Thu, 8 Oct 2020 16:22:27 -0700 Subject: [PATCH] msm: ipa: Fix use-after-free in ipa3_alloc_counter_id Make changes to memcopy before preload end. Change-Id: Icc056a3bcd5b739b8165813202c87dd84e72c78a Signed-off-by: Michael Adisumarta --- drivers/platform/msm/ipa/ipa_v3/ipa_utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c index 7c44b78b87c9..5b40376d7d1a 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c @@ -7057,9 +7057,9 @@ mark_sw_cnt: done: /* get a handle from idr for dealloc */ counter->hdl = __ipa3_alloc_counter_hdl(counter); + memcpy(header, counter, sizeof(struct ipa_ioc_flt_rt_counter_alloc)); spin_unlock(&ipa3_ctx->flt_rt_counters.hdl_lock); idr_preload_end(); - memcpy(header, counter, sizeof(struct ipa_ioc_flt_rt_counter_alloc)); return 0; err: