Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b4163de authored by Michael Adisumarta's avatar Michael Adisumarta Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa: Fix use-after-free in ipa3_alloc_counter_id 



Make changes to memcopy before preload end.

Change-Id: 	Icc056a3bcd5b739b8165813202c87dd84e72c78a
Signed-off-by: default avatarMichael Adisumarta <madisuma@codeaurora.org>
parent a5eb56f5

drivers/platform/msm/ipa/ipa_v3/ipa_utils.c

+1 −1
Original line number Diff line number Diff line
@@ -6210,9 +6210,9 @@ int ipa3_alloc_counter_id(struct ipa_ioc_flt_rt_counter_alloc *header) 
done:

	/* get a handle from idr for dealloc */

	counter->hdl = __ipa3_alloc_counter_hdl(counter);

	memcpy(header, counter, sizeof(struct ipa_ioc_flt_rt_counter_alloc));

	spin_unlock(&ipa3_ctx->flt_rt_counters.hdl_lock);

	idr_preload_end();

	memcpy(header, counter, sizeof(struct ipa_ioc_flt_rt_counter_alloc));

	return 0;



err: