From 4dd23ac1ac2a7cc819769efadf5f4df863e622bf Mon Sep 17 00:00:00 2001 From: Sai Chaitanya Kaveti Date: Tue, 15 Nov 2022 15:50:12 +0530 Subject: [PATCH] msm: mhi_dev: Avoiding double free in MHI UCI layer In mhi_uci_ctrl_set_tiocm(), the control message is submitted to MHI/IPA using mhi_uci_send_packet(). Device waits for completion after this. If the wait is interrupted or is timed out, control message buffer is freed using kfree(). But as the message is already sent, write completion callback is invoked after buffer is freed and same pointer is being freed again. To avoid this double free issue, removing kfree() in mhi_uci_ctrl_set_tiocm(). Once sending of the message is completed, buffer is freed as part of the write completion callback. Change-Id: I6e33ce46fc5506ac45256102221fafb08050a5b5 Signed-off-by: Sai Chaitanya Kaveti --- drivers/platform/msm/mhi_dev/mhi_uci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/platform/msm/mhi_dev/mhi_uci.c b/drivers/platform/msm/mhi_dev/mhi_uci.c index d8c8f8655f25..222c71854d3b 100644 --- a/drivers/platform/msm/mhi_dev/mhi_uci.c +++ b/drivers/platform/msm/mhi_dev/mhi_uci.c @@ -1748,8 +1748,12 @@ static int mhi_uci_ctrl_set_tiocm(struct uci_client *client, reinit_completion(ctrl_client->write_done); ret_val = mhi_uci_send_packet(ctrl_client, ctrl_msg, sizeof(*ctrl_msg)); - if (ret_val != sizeof(*ctrl_msg)) + if (ret_val != sizeof(*ctrl_msg)) { + uci_log(UCI_DBG_ERROR, "Failed to send ctrl msg\n"); + kfree(ctrl_msg); + ctrl_msg = NULL; goto tiocm_error; + } compl_ret = wait_for_completion_interruptible_timeout( ctrl_client->write_done, MHI_UCI_ASYNC_WRITE_TIMEOUT); @@ -1768,7 +1772,6 @@ static int mhi_uci_ctrl_set_tiocm(struct uci_client *client, return 0; tiocm_error: - kfree(ctrl_msg); return ret_val; }