duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

memshare: Free QMI handle only if its valid

Browse Source 
Avoid possible use-after-free access for a QMI handle
during driver deinit by ensuring the free happens only for
valid QMI handle and is marked NULL post free.

Change-Id: I4314dff560de2fc3aea30d636f935d7a02067a57
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
This commit is contained in:
Manoj Prabhu B committed 2022-12-01 19:12:23 +05:30
1 parent 6401a85525
commit e6fa19adf1
1 file changed
+12 -4
Download Patch File Download Diff File Expand all files Collapse all files
drivers/soc/qcom/memshare/msm_memshare.c
+12 -4
View File
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/err.h>
@@ -751,6 +752,7 @@ static void memshare_init_worker(struct work_struct *work)
dev_err(memsh_child->dev,
"memshare: Creating mem_share_svc qmi handle failed\n");
kfree(mem_share_svc_handle);
mem_share_svc_handle = NULL;
destroy_workqueue(mem_share_svc_workqueue);
return;
}
@@ -759,8 +761,11 @@ static void memshare_init_worker(struct work_struct *work)
if (rc < 0) {
dev_err(memsh_child->dev,
"memshare: Registering mem share svc failed %d\n", rc);
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
if (mem_share_svc_handle) {
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
mem_share_svc_handle = NULL;
}
destroy_workqueue(mem_share_svc_workqueue);
return;
}
@@ -917,8 +922,11 @@ static int memshare_remove(struct platform_device *pdev)
return 0;
flush_workqueue(mem_share_svc_workqueue);
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
if (mem_share_svc_handle) {
qmi_handle_release(mem_share_svc_handle);
kfree(mem_share_svc_handle);
mem_share_svc_handle = NULL;
}
destroy_workqueue(mem_share_svc_workqueue);
return 0;
}