A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: ipa: fix use-after-free of rt_tbl

Browse source 
Fix use-after-free of rt_tbl in __ipa_del_flt_rule
by checking if the rt_tbl is already freed.

Change-Id: I09541f65f474dc42f262c603d99f6bbcbb0ce8ec
Signed-off-by: Goutam Bose <gbose@codeaurora.org>
This commit is contained in:
Goutam Bose 2021-06-30 11:43:45 +05:30
commit bf9c2b1168
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/platform/msm/ipa/ipa_v3/ipa_flt.c
View file

@ -1078,7 +1078,7 @@ static int __ipa_del_flt_rule(u32 rule_hdl)
list_del(&entry->link);
entry->tbl->rule_cnt--;
if (entry->rt_tbl)
if (entry->rt_tbl && !ipa3_check_idr_if_freed(entry->rt_tbl))
entry->rt_tbl->ref_cnt--;
IPADBG("del flt rule rule_cnt=%d rule_id=%d\n",
entry->tbl->rule_cnt, entry->rule_id);