A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: mhi_dev: UCI memory leak fix

Browse source 
mhi_init_read_chan() allocates max_packet_size*nr_trbs for async client for
inbound channel. Multiple open/close of channels can cause memory leak.
Adding free operation during channel release to resolve this.

Change-Id: I7be4d47d28140a4d04b5070cb7db776a7f909238
Signed-off-by: Subramanian Ananthanarayanan <skananth@codeaurora.org>
Signed-off-by: Gauri Joshi <gaurjosh@codeaurora.org>
This commit is contained in:
Subramanian Ananthanarayanan 2020-11-24 12:41:33 +05:30 • committed by Gauri Joshi
commit c4c214940e
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/platform/msm/mhi_dev/mhi_uci.c
View file

@ -1069,12 +1069,20 @@ static int mhi_uci_client_release(struct inode *mhi_inode,
struct file *file_handle)
{
struct uci_client *uci_handle = file_handle->private_data;
int count = 0;
const struct chan_attr *in_chan_attr;
int count = 0, i;
struct mhi_req *ureq;
if (!uci_handle)
return -EINVAL;
in_chan_attr = uci_handle->in_chan_attr;
if (!in_chan_attr) {
uci_log(UCI_DBG_ERROR, "Null channel attributes for chan %d\n",
uci_handle->in_chan);
return -EINVAL;
}
if (atomic_sub_return(1, &uci_handle->ref_count)) {
uci_log(UCI_DBG_DBG, "Client close chan %d, ref count 0x%x\n",
iminor(mhi_inode),
@ -1133,6 +1141,12 @@ static int mhi_uci_client_release(struct inode *mhi_inode,
iminor(mhi_inode), count);
}
for (i = 0; i < (in_chan_attr->nr_trbs); i++) {
kfree(uci_handle->in_buf_list[i].addr);
uci_handle->in_buf_list[i].addr = NULL;
uci_handle->in_buf_list[i].buf_size = 0;
}
atomic_set(&uci_handle->read_data_ready, 0);
atomic_set(&uci_handle->write_data_ready, 0);
file_handle->private_data = NULL;