Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b49f6d83 authored by Thierry Escande's avatar Thierry Escande Committed by Greg Kroah-Hartman
Browse files

misc: fastrpc: Fix a possible double free 



This patch fixes the error exit path of fastrpc_init_create_process().
If the DMA allocation or the DSP invoke fails the fastrpc_map was freed
but not removed from the mapping list leading to a double free once the
mapping list is emptied in fastrpc_device_release().

[srinivas kandagatla]: Cleaned up error path labels and reset init mem
to NULL after free
Fixes: d73f71c7("misc: fastrpc: Add support for create remote init process")
Signed-off-by: default avatarThierry Escande <thierry.escande@linaro.org>
Signed-off-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8e7389c7

drivers/misc/fastrpc.c

+20 −11
Original line number Diff line number Diff line
@@ -853,12 +853,12 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, 


	if (copy_from_user(&init, argp, sizeof(init))) {

		err = -EFAULT;

		goto bail;

		goto err;

	}



	if (init.filelen > INIT_FILELEN_MAX) {

		err = -EINVAL;

		goto bail;

		goto err;

	}



	inbuf.pgid = fl->tgid;
@@ -872,17 +872,15 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, 
	if (init.filelen && init.filefd) {

		err = fastrpc_map_create(fl, init.filefd, init.filelen, &map);

		if (err)

			goto bail;

			goto err;

	}



	memlen = ALIGN(max(INIT_FILELEN_MAX, (int)init.filelen * 4),

		       1024 * 1024);

	err = fastrpc_buf_alloc(fl, fl->sctx->dev, memlen,

				&imem);

	if (err) {

		fastrpc_map_put(map);

		goto bail;

	}

	if (err)

		goto err_alloc;



	fl->init_mem = imem;

	args[0].ptr = (u64)(uintptr_t)&inbuf;
@@ -918,13 +916,24 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, 


	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,

				      sc, args);

	if (err)

		goto err_invoke;



	if (err) {

		fastrpc_map_put(map);

	kfree(args);



	return 0;



err_invoke:

	fl->init_mem = NULL;

	fastrpc_buf_free(imem);

err_alloc:

	if (map) {

		spin_lock(&fl->lock);

		list_del(&map->node);

		spin_unlock(&fl->lock);

		fastrpc_map_put(map);

	}



bail:

err:

	kfree(args);



	return err;