From 1bcfee37cb831268c6111a31c9720fbeb8a0132c Mon Sep 17 00:00:00 2001 From: Sai Chaitanya Kaveti Date: Tue, 21 Jun 2022 20:57:43 +0530 Subject: [PATCH] msm: mhi_dev: Avoiding null pointer dereference in uci layer Avoiding null pointer dereference in mhi_uci_client_open API in uci layer by changing the location of the condition check for uci_handle. Change-Id: If2cc99f47f4c5d05d0df4a5b4900894683f7c8d1 Signed-off-by: Sai Chaitanya Kaveti --- drivers/platform/msm/mhi_dev/mhi_uci.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/platform/msm/mhi_dev/mhi_uci.c b/drivers/platform/msm/mhi_dev/mhi_uci.c index 53ddfc75ab42..e65264480c75 100644 --- a/drivers/platform/msm/mhi_dev/mhi_uci.c +++ b/drivers/platform/msm/mhi_dev/mhi_uci.c @@ -1081,17 +1081,16 @@ static int mhi_uci_client_open(struct inode *mhi_inode, return -EINVAL; } + if (!uci_handle) { + uci_log(UCI_DBG_DBG, "No memory, returning failure\n"); + return -ENOMEM; + } + mutex_lock(&uci_handle->client_lock); uci_log(UCI_DBG_DBG, "Client opened struct device node 0x%x, ref count 0x%x\n", iminor(mhi_inode), atomic_read(&uci_handle->ref_count)); if (atomic_add_return(1, &uci_handle->ref_count) == 1) { - if (!uci_handle) { - atomic_dec(&uci_handle->ref_count); - uci_log(UCI_DBG_DBG, "No memory, returning failure\n"); - mutex_unlock(&uci_handle->client_lock); - return -ENOMEM; - } uci_handle->uci_ctxt = &uci_ctxt; uci_handle->f_flags = file_handle->f_flags; if (!atomic_read(&uci_handle->mhi_chans_open)) {