Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a86c0e86 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ipa: fix double-free of memory"

parents 01364e16 d2f28951

drivers/platform/msm/ipa/a2_service.c

+2 −3
Original line number Diff line number Diff line
@@ -900,7 +900,6 @@ static int a2_mux_write_cmd(void *data, u32 len) 
		return -ENOMEM;

	}

	memcpy(skb_put(pkt->skb, len), data, len);

	kfree(data);

	pkt->len = len;

	pkt->is_cmd = 1;

	set_tx_timestamp(pkt);
@@ -1332,10 +1331,10 @@ int a2_mux_open_channel(enum a2_mux_logical_channel_id lcid, 
		    hdr->magic_num, hdr->pkt_len);

		rc = a2_mux_write_cmd((void *)hdr,

				       sizeof(struct bam_mux_hdr));

		kfree(hdr);

		if (rc) {

			IPAERR("%s: bam_mux_write_cmd failed %d; ch: %d\n",

			       __func__, rc, lcid);

			kfree(hdr);

			return rc;

		}

		rc = a2_mux_add_hdr(lcid);
@@ -1402,10 +1401,10 @@ int a2_mux_close_channel(enum a2_mux_logical_channel_id lcid) 
		IPADBG("convert to network order magic_num=%d, pkt_len=%d\n",

		    hdr->magic_num, hdr->pkt_len);

		rc = a2_mux_write_cmd((void *)hdr, sizeof(struct bam_mux_hdr));

		kfree(hdr);

		if (rc) {

			IPAERR("%s: bam_mux_write_cmd failed %d; ch: %d\n",

			       __func__, rc, lcid);

			kfree(hdr);

			return rc;

		}