A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 13:49:24 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: ipa3: Fix to NULL terminate the header pointer in proc header table

Browse source 
While resetting the header rules if it find invalid header ID it
will return before freeting proc header table it was leading to use
after free when accessing the header pointer from proc header table.
Adding changes to NULL terminating header pointer in proc header table
after header table deleted from the list.

Change-Id: If270d855d3907e61368336316161a250053e1e62
Signed-off-by: Ashok Vuyyuru <avuyyuru@codeaurora.org>
This commit is contained in:
Ashok Vuyyuru 2021-10-20 01:13:15 +05:30
commit cfe6d558b2
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c
View file

@ -1084,6 +1084,7 @@ int ipa3_reset_hdr(bool user_only)
if (ipa3_id_find(entry->id) == NULL) {
mutex_unlock(&ipa3_ctx->lock);
IPAERR_RL("Invalid header ID\n");
WARN_ON_RATELIMIT_IPA(1);
return -EFAULT;
}
@ -1094,6 +1095,7 @@ int ipa3_reset_hdr(bool user_only)
entry->phys_base,
entry->hdr_len,
DMA_TO_DEVICE);
entry->proc_ctx->hdr = NULL;
entry->proc_ctx = NULL;
} else {
/* move the offset entry to free list */
@ -1151,6 +1153,7 @@ int ipa3_reset_hdr(bool user_only)
if (ipa3_id_find(ctx_entry->id) == NULL) {
mutex_unlock(&ipa3_ctx->lock);
IPAERR_RL("Invalid proc header ID\n");
WARN_ON_RATELIMIT_IPA(1);
return -EFAULT;
}