From 45edd7ec797d479b3113f780b9867044a98c090f Mon Sep 17 00:00:00 2001 From: Nitesh Gupta Date: Mon, 8 Mar 2021 13:23:07 +0530 Subject: [PATCH] msm: mhi_dev: free allocated memory in reverse order of allocation Freeing cmd_ctx before ereqs will result into NULL ptr dereference. Freeing memory in proper order. Change-Id: Ie999017685574e940685eee3b7c205ebe1672664 Signed-off-by: Nitesh Gupta Signed-off-by: Gauri Joshi --- drivers/platform/msm/mhi_dev/mhi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/platform/msm/mhi_dev/mhi.c b/drivers/platform/msm/mhi_dev/mhi.c index 573911877588..01d2c5dd4e7c 100644 --- a/drivers/platform/msm/mhi_dev/mhi.c +++ b/drivers/platform/msm/mhi_dev/mhi.c @@ -2978,8 +2978,8 @@ static int mhi_dev_alloc_cmd_ack_buf_req(struct mhi_dev *mhi) sizeof(*cmd_ctx->ereqs), GFP_KERNEL); if (!cmd_ctx->ereqs) { + rc = -ENOMEM; goto free_ereqs; - return -ENOMEM; } /* Allocate buffers to queue transfer completion events */ @@ -3008,9 +3008,13 @@ static int mhi_dev_alloc_cmd_ack_buf_req(struct mhi_dev *mhi) return 0; free_ereqs: - kfree(mhi->cmd_ctx); kfree(cmd_ctx->ereqs); cmd_ctx->ereqs = NULL; + + kfree(mhi->cmd_ctx); + mhi_log(MHI_MSG_INFO, + "MEM_DEALLOC: size:%d CMD_CTX\n", + sizeof(struct mhi_cmd_cmpl_ctx)); mhi->cmd_ctx = NULL; return rc; }