A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "haven: dbl: Fix use-after-free in tx/rx unregister"

Browse source
This commit is contained in:
qctecmdr 2020-06-08 17:54:15 -07:00 • committed by Gerrit - the friendly Code Review server
commit d4c0865117
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/virt/haven/hh_dbl.c
View file

@ -443,6 +443,9 @@ int hh_dbl_tx_unregister(void *dbl_client_desc)
return -EINVAL;
}
pr_debug("%s: Unregistering client for label: %d\n",
__func__, client_desc->label);
/* Rx client still holding the "client_desc". Do not remove now. */
if (!cap_table_entry->rx_reg_done) {
cap_table_entry->client_desc = NULL;
@ -454,9 +457,6 @@ int hh_dbl_tx_unregister(void *dbl_client_desc)
cap_table_entry->tx_reg_done = 0;
mutex_unlock(&cap_table_entry->cap_entry_lock);
pr_debug("%s: Unregistered client for label: %d\n",
__func__, client_desc->label);
return 0;
}
EXPORT_SYMBOL(hh_dbl_tx_unregister);
@ -494,6 +494,9 @@ int hh_dbl_rx_unregister(void *dbl_client_desc)
return -EINVAL;
}
pr_debug("%s: Unregistering client for label: %d\n", __func__,
client_desc->label);
/* Tx client still holding the "client_desc". Do not remove now.*/
if (!cap_table_entry->tx_reg_done) {
cap_table_entry->client_desc = NULL;
@ -508,9 +511,6 @@ int hh_dbl_rx_unregister(void *dbl_client_desc)
mutex_unlock(&cap_table_entry->cap_entry_lock);
pr_debug("%s: Unregistered client for label: %d\n", __func__,
client_desc->label);
return 0;
}
EXPORT_SYMBOL(hh_dbl_rx_unregister);