A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 12:58:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

memshare: Free QMI handle only if its valid

Browse source 
Avoid possible use-after-free access for a QMI handle
during driver deinit by ensuring the free happens only for
valid QMI handle and is marked NULL post free.

Change-Id: I4314dff560de2fc3aea30d636f935d7a02067a57
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
This commit is contained in:
Manoj Prabhu B 2022-12-01 18:52:09 +05:30
commit 9dcfdde71f
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/soc/qcom/memshare/msm_memshare.c
View file

@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/err.h>
@ -779,6 +780,7 @@ static void memshare_init_worker(struct work_struct *work)
dev_err(memsh_drv->dev,
"memshare: Creating mem_share_svc qmi handle failed\n");
kfree(mem_share_svc_handle);
mem_share_svc_handle = NULL;
destroy_workqueue(mem_share_svc_workqueue);
return;
}
@ -787,8 +789,11 @@ static void memshare_init_worker(struct work_struct *work)
if (rc < 0) {
dev_err(memsh_drv->dev,
"memshare: Registering mem share svc failed %d\n", rc);
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
if (mem_share_svc_handle) {
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
mem_share_svc_handle = NULL;
}
destroy_workqueue(mem_share_svc_workqueue);
return;
}
@ -971,8 +976,11 @@ static int memshare_remove(struct platform_device *pdev)
return 0;
flush_workqueue(mem_share_svc_workqueue);
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
if (mem_share_svc_handle) {
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
mem_share_svc_handle = NULL;
}
destroy_workqueue(mem_share_svc_workqueue);
return 0;
}