From f181465e1fb98b8a4db498d0792e8a04b464f5bb Mon Sep 17 00:00:00 2001 From: Ashok Vuyyuru Date: Thu, 29 Oct 2020 23:35:22 +0530 Subject: [PATCH] msm: ipa3: Fix to avoid NULL pointer access Adding changes to check ipa_q6_clnt pointer NULL or not before accessing it. Change-Id: I255dd021c9534fe6ca4d7b19c3b576a0d3c80c7d Signed-off-by: Ashok Vuyyuru --- .../platform/msm/ipa/ipa_v3/ipa_qmi_service.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c index e9d1c84f968b..51b229a99fd1 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c @@ -1512,11 +1512,14 @@ static void ipa3_q6_clnt_svc_arrive(struct work_struct *work) IPAWANERR( "ipa3_qmi_init_modem_send_sync_msg failed due to SSR!\n"); /* Cleanup when ipa3_wwan_remove is called */ - mutex_lock(&ipa3_qmi_lock); - qmi_handle_release(ipa_q6_clnt); - vfree(ipa_q6_clnt); - ipa_q6_clnt = NULL; - mutex_unlock(&ipa3_qmi_lock); + if (ipa_q6_clnt != NULL) { + mutex_lock(&ipa3_qmi_lock); + qmi_handle_release(ipa_q6_clnt); + vfree(ipa_q6_clnt); + ipa_q6_clnt = NULL; + mutex_unlock(&ipa3_qmi_lock); + } + IPAWANERR("Exit from service arrive fun\n"); return; } @@ -2143,6 +2146,8 @@ int ipa3_qmi_enable_per_client_stats( IPAWANDBG("Sending QMI_IPA_ENABLE_PER_CLIENT_STATS_REQ_V01\n"); + if (unlikely(!ipa_q6_clnt)) + return -ETIMEDOUT; rc = ipa3_qmi_send_req_wait(ipa_q6_clnt, &req_desc, req, &resp_desc, resp, @@ -2180,6 +2185,8 @@ int ipa3_qmi_get_per_client_packet_stats( IPAWANDBG("Sending QMI_IPA_GET_STATS_PER_CLIENT_REQ_V01\n"); + if (unlikely(!ipa_q6_clnt)) + return -ETIMEDOUT; rc = ipa3_qmi_send_req_wait(ipa_q6_clnt, &req_desc, req, &resp_desc, resp, @@ -2237,6 +2244,8 @@ int ipa3_qmi_send_mhi_cleanup_request(struct ipa_mhi_cleanup_req_msg_v01 *req) resp_desc.msg_id = QMI_IPA_MHI_CLEANUP_RESP_V01; resp_desc.ei_array = ipa_mhi_cleanup_resp_msg_v01_ei; + if (unlikely(!ipa_q6_clnt)) + return -ETIMEDOUT; rc = ipa3_qmi_send_req_wait(ipa_q6_clnt, &req_desc, req, &resp_desc, &resp,