Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 45edd7ec authored by Nitesh Gupta's avatar Nitesh Gupta Committed by Gauri Joshi
Browse files

msm: mhi_dev: free allocated memory in reverse order of allocation 



Freeing cmd_ctx before ereqs will result into NULL ptr
dereference. Freeing memory in proper order.

Change-Id: Ie999017685574e940685eee3b7c205ebe1672664
Signed-off-by: default avatarNitesh Gupta <nitegupt@codeaurora.org>
Signed-off-by: default avatarGauri Joshi <gaurjosh@codeaurora.org>
parent e623db90

drivers/platform/msm/mhi_dev/mhi.c

+6 −2
Original line number Diff line number Diff line
@@ -2978,8 +2978,8 @@ static int mhi_dev_alloc_cmd_ack_buf_req(struct mhi_dev *mhi) 
						sizeof(*cmd_ctx->ereqs),

						GFP_KERNEL);

	if (!cmd_ctx->ereqs) {

		rc = -ENOMEM;

		goto free_ereqs;

		return -ENOMEM;

	}



	/* Allocate buffers to queue transfer completion events */
@@ -3008,9 +3008,13 @@ static int mhi_dev_alloc_cmd_ack_buf_req(struct mhi_dev *mhi) 


	return 0;

free_ereqs:

		kfree(mhi->cmd_ctx);

		kfree(cmd_ctx->ereqs);

		cmd_ctx->ereqs = NULL;



		kfree(mhi->cmd_ctx);

		mhi_log(MHI_MSG_INFO,

				"MEM_DEALLOC: size:%d CMD_CTX\n",

				sizeof(struct mhi_cmd_cmpl_ctx));

		mhi->cmd_ctx = NULL;

		return rc;

}