A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 16:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: f_fs: Fix memory leak if copy_from_iter_full fails

Browse source 
Consider a case where copy_from_iter_full fails and it
leads the driver to free the buffer which is allocated
for io_data but in ffs_free_buffer function, driver checks
for io_data->buf, which is NULL in this case, and it returns
without freeing the buffer causing memory leak. Fix this by
assigning data to io_data->buf right after memory allocation
for io_data is successful.

Change-Id: I20719fdeed603b74fe05215ec057d4cc22379ab2
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
This commit is contained in:
Pratham Pratap 2020-09-22 20:11:50 +05:30
commit caa6c4b6bd
1 changed files with 1 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/usb/gadget/function/f_fs.c
View file

@ -1106,6 +1106,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
ret = -ENOMEM;
goto error_mutex;
}
io_data->buf = data;
if (!io_data->read &&
!copy_from_iter_full(data, data_len, &io_data->data)) {
ret = -EFAULT;
@ -1151,8 +1152,6 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
}
req->length = data_len;
io_data->buf = data;
req->context = &done;
req->complete = ffs_epfile_io_complete;
@ -1200,7 +1199,6 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
}
req->length = data_len;
io_data->buf = data;
io_data->ep = ep->ep;
io_data->req = req;
io_data->ffs = epfile->ffs;