A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:11:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: camera: reqmgr: Avoid freeing subdev twice

Browse source 
The 'l_device' pointer in __cam_req_mgr_destroy_subdev is
set to NULL after freeing but this is done on a
local copy of the variable in stack. This results in
double-free when this function is called again. To avoid
this, pass 'l_device' pointer by reference and assign it
to NULL after freeing.

CRs-Fixed: 3120468
Change-Id: If2dde6f1c702bee26a3c8a68c2f45bafbf0f7cd6
Signed-off-by: Nirmal Abraham <quic_c_nabrah@quicinc.com>
This commit is contained in:
Nirmal Abraham 2022-02-03 12:09:19 +05:30
commit 583fb300c8
1 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/cam_req_mgr/cam_req_mgr_core.c
View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/module.h>
@ -2281,10 +2282,13 @@ static int __cam_req_mgr_create_subdevs(
*
*/
static void __cam_req_mgr_destroy_subdev(
struct cam_req_mgr_connected_device *l_device)
struct cam_req_mgr_connected_device **l_device)
{
kfree(l_device);
l_device = NULL;
CAM_DBG(CAM_CRM, "*l_device %pK", *l_device);
if (*(l_device) != NULL) {
kfree(*(l_device));
*l_device = NULL;
}
}
/**
@ -3820,7 +3824,7 @@ static int __cam_req_mgr_unlink(struct cam_req_mgr_core_link *link)
__cam_req_mgr_destroy_link_info(link);
/* Free memory holding data of linked devs */
__cam_req_mgr_destroy_subdev(link->l_dev);
__cam_req_mgr_destroy_subdev(&link->l_dev);
/* Destroy the link handle */
rc = cam_destroy_device_hdl(link->link_hdl);
@ -3995,7 +3999,7 @@ int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info)
mutex_unlock(&g_crm_core_dev->crm_lock);
return rc;
setup_failed:
__cam_req_mgr_destroy_subdev(link->l_dev);
__cam_req_mgr_destroy_subdev(&link->l_dev);
create_subdev_failed:
cam_destroy_device_hdl(link->link_hdl);
link_info->u.link_info_v1.link_hdl = -1;
@ -4111,7 +4115,7 @@ int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info)
mutex_unlock(&g_crm_core_dev->crm_lock);
return rc;
setup_failed:
__cam_req_mgr_destroy_subdev(link->l_dev);
__cam_req_mgr_destroy_subdev(&link->l_dev);
create_subdev_failed:
cam_destroy_device_hdl(link->link_hdl);
link_info->u.link_info_v2.link_hdl = -1;