A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: mhi_dev: free allocated memory in reverse order of allocation

Browse source 
Freeing cmd_ctx before ereqs will result into NULL ptr
dereference. Freeing memory in proper order.

Change-Id: Ie999017685574e940685eee3b7c205ebe1672664
Signed-off-by: Nitesh Gupta <nitegupt@codeaurora.org>
Signed-off-by: Gauri Joshi <gaurjosh@codeaurora.org>
This commit is contained in:
Nitesh Gupta 2021-03-08 13:23:07 +05:30 • committed by Gauri Joshi
commit 45edd7ec79
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/platform/msm/mhi_dev/mhi.c
View file

@ -2978,8 +2978,8 @@ static int mhi_dev_alloc_cmd_ack_buf_req(struct mhi_dev *mhi)
sizeof(*cmd_ctx->ereqs),
GFP_KERNEL);
if (!cmd_ctx->ereqs) {
rc = -ENOMEM;
goto free_ereqs;
return -ENOMEM;
}
/* Allocate buffers to queue transfer completion events */
@ -3008,9 +3008,13 @@ static int mhi_dev_alloc_cmd_ack_buf_req(struct mhi_dev *mhi)
return 0;
free_ereqs:
kfree(mhi->cmd_ctx);
kfree(cmd_ctx->ereqs);
cmd_ctx->ereqs = NULL;
kfree(mhi->cmd_ctx);
mhi_log(MHI_MSG_INFO,
"MEM_DEALLOC: size:%d CMD_CTX\n",
sizeof(struct mhi_cmd_cmpl_ctx));
mhi->cmd_ctx = NULL;
return rc;
}