From c4c214940e139f571febeb7de9cd6de70cebf1e2 Mon Sep 17 00:00:00 2001 From: Subramanian Ananthanarayanan Date: Tue, 24 Nov 2020 12:41:33 +0530 Subject: [PATCH] msm: mhi_dev: UCI memory leak fix mhi_init_read_chan() allocates max_packet_size*nr_trbs for async client for inbound channel. Multiple open/close of channels can cause memory leak. Adding free operation during channel release to resolve this. Change-Id: I7be4d47d28140a4d04b5070cb7db776a7f909238 Signed-off-by: Subramanian Ananthanarayanan Signed-off-by: Gauri Joshi --- drivers/platform/msm/mhi_dev/mhi_uci.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/platform/msm/mhi_dev/mhi_uci.c b/drivers/platform/msm/mhi_dev/mhi_uci.c index 689a46a9a906..3ce9e0f93877 100644 --- a/drivers/platform/msm/mhi_dev/mhi_uci.c +++ b/drivers/platform/msm/mhi_dev/mhi_uci.c @@ -1069,12 +1069,20 @@ static int mhi_uci_client_release(struct inode *mhi_inode, struct file *file_handle) { struct uci_client *uci_handle = file_handle->private_data; - int count = 0; + const struct chan_attr *in_chan_attr; + int count = 0, i; struct mhi_req *ureq; if (!uci_handle) return -EINVAL; + in_chan_attr = uci_handle->in_chan_attr; + if (!in_chan_attr) { + uci_log(UCI_DBG_ERROR, "Null channel attributes for chan %d\n", + uci_handle->in_chan); + return -EINVAL; + } + if (atomic_sub_return(1, &uci_handle->ref_count)) { uci_log(UCI_DBG_DBG, "Client close chan %d, ref count 0x%x\n", iminor(mhi_inode), @@ -1133,6 +1141,12 @@ static int mhi_uci_client_release(struct inode *mhi_inode, iminor(mhi_inode), count); } + for (i = 0; i < (in_chan_attr->nr_trbs); i++) { + kfree(uci_handle->in_buf_list[i].addr); + uci_handle->in_buf_list[i].addr = NULL; + uci_handle->in_buf_list[i].buf_size = 0; + } + atomic_set(&uci_handle->read_data_ready, 0); atomic_set(&uci_handle->write_data_ready, 0); file_handle->private_data = NULL;