From bf9c2b116819c754ebf0ce308fbdcccc528bb16a Mon Sep 17 00:00:00 2001 From: Goutam Bose Date: Wed, 30 Jun 2021 11:43:45 +0530 Subject: [PATCH] msm: ipa: fix use-after-free of rt_tbl Fix use-after-free of rt_tbl in __ipa_del_flt_rule by checking if the rt_tbl is already freed. Change-Id: I09541f65f474dc42f262c603d99f6bbcbb0ce8ec Signed-off-by: Goutam Bose --- drivers/platform/msm/ipa/ipa_v3/ipa_flt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c index 4aeab4968f2a..f71b4346b186 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c @@ -1078,7 +1078,7 @@ static int __ipa_del_flt_rule(u32 rule_hdl) list_del(&entry->link); entry->tbl->rule_cnt--; - if (entry->rt_tbl) + if (entry->rt_tbl && !ipa3_check_idr_if_freed(entry->rt_tbl)) entry->rt_tbl->ref_cnt--; IPADBG("del flt rule rule_cnt=%d rule_id=%d\n", entry->tbl->rule_cnt, entry->rule_id);