Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70a9c3e0 authored by Skylar Chang's avatar Skylar Chang Committed by Mohammed Javid
Browse files

msm: ipa3: fix the Use-after-free in ipa3_dma_destroy 



Move the kfree of ipa3_dma_ctx after finishing the
accessing during clean-up.

Change-Id: Ic7c82fd083ecab069e71b4ba21b04dc88cf9dbad
Signed-off-by: default avatarSkylar Chang <chiaweic@codeaurora.org>
parent f035a4ad

drivers/platform/msm/ipa/ipa_v3/ipa_dma.c

+1 −1
Original line number Diff line number Diff line
@@ -939,10 +939,10 @@ void ipa3_dma_destroy(void) 


	ipa3_dma_debugfs_destroy();

	kmem_cache_destroy(ipa3_dma_ctx->ipa_dma_xfer_wrapper_cache);

	kfree(ipa3_dma_ctx);

	dma_free_coherent(ipa3_ctx->pdev, IPA_DMA_DUMMY_BUFF_SZ * 4,

		ipa3_dma_ctx->ipa_dma_dummy_src_sync.base,

		ipa3_dma_ctx->ipa_dma_dummy_src_sync.phys_base);

	kfree(ipa3_dma_ctx);

	ipa3_dma_ctx = NULL;



	IPADMA_FUNC_EXIT();