A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 20:33:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: mhi_dev: Ensure event buffer size reflects the right size

Browse source 
We are setting event buffer size with the requested size and then
allocating the buffer for event requests (ereqs). But if the memory
allocation for ereq buffer fails, the event-buffer-size variable
is not getting set to zero.

Due to this, if a client calls open channel multiple times,
our logic proceeded without really allocating the buffer for ereqs.
And while processing completion events, we are observing null pointer
dereference issues.

Change-Id: I10bee8428d178ef5a7f0fe5fcd93fcce8dcbe27d
Signed-off-by: Veerabhadrarao Badiganti <quic_vbadigan@quicinc.com>
This commit is contained in:
Veerabhadrarao Badiganti 2021-11-18 20:31:32 +05:30
commit eb29f2d763
2 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
drivers/platform/msm/mhi_dev/mhi.c
View file

@ -3098,13 +3098,20 @@ static int mhi_dev_alloc_evt_buf_evt_req(struct mhi_dev *mhi,
/* Allocate event requests */
ch->ereqs = kcalloc(ch->evt_req_size, sizeof(*ch->ereqs), GFP_KERNEL);
if (!ch->ereqs)
return -ENOMEM;
if (!ch->ereqs) {
mhi_log(MHI_MSG_ERROR,
"Failed to alloc ereqs for Channel %d\n", ch->ch_id);
rc = -ENOMEM;
goto free_ereqs;
}
/* Allocate buffers to queue transfer completion events */
ch->tr_events = kcalloc(ch->evt_buf_size, sizeof(*ch->tr_events),
GFP_KERNEL);
if (!ch->tr_events) {
mhi_log(MHI_MSG_ERROR,
"Failed to alloc tr_events buffer for Channel %d\n",
ch->ch_id);
rc = -ENOMEM;
goto free_ereqs;
}

6
drivers/platform/msm/mhi_dev/mhi_uci.c
View file

@ -651,7 +651,7 @@ static int mhi_uci_send_async(struct uci_client *uci_handle,
int bytes_to_write;
struct mhi_req *ureq;
uci_log(UCI_DBG_VERBOSE,
uci_log(UCI_DBG_DBG,
"Async write for ch %d size %d\n",
uci_handle->out_chan, size);
@ -865,7 +865,7 @@ static int mhi_uci_read_async(struct uci_client *uci_handle, int *bytes_avail)
struct mhi_req *ureq;
struct mhi_dev_client *client_handle;
uci_log(UCI_DBG_ERROR,
uci_log(UCI_DBG_DBG,
"Async read for ch %d\n", uci_handle->in_chan);
ureq = mhi_uci_get_req(uci_handle);
@ -1031,7 +1031,7 @@ static int open_client_mhi_channels(struct uci_client *uci_client)
uci_ctxt.event_notifier);
if (rc < 0) {
uci_log(UCI_DBG_ERROR,
"Failed to open chan %d, ret 0x%x\n",
"Failed to open chan %d, ret %d\n",
uci_client->out_chan, rc);
goto handle_in_err;
}