Merge "soc: qcom: sysmon-qmi: fix object corruption due to use after free" (307e1d36) · Commits · e / devices / android_kernel_sony_msm8998

drivers/soc/qcom/sysmon-qmi.c

+7 −1

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
		* Copyright (c) 2014-2015, 2017, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -153,10 +153,12 @@ static void sysmon_clnt_svc_arrive(struct work_struct *work)
		struct sysmon_qmi_data *data = container_of(work,
		struct sysmon_qmi_data, svc_arrive);

		mutex_lock(&sysmon_lock);
		/* Create a Local client port for QMI communication */
		data->clnt_handle = qmi_handle_create(sysmon_clnt_notify, work);
		if (!data->clnt_handle) {
		pr_err("QMI client handle alloc failed for %s\n", data->name);
		mutex_unlock(&sysmon_lock);
		return;
		}

		@@ -167,6 +169,7 @@ static void sysmon_clnt_svc_arrive(struct work_struct *work)
		data->name);
		qmi_handle_destroy(data->clnt_handle);
		data->clnt_handle = NULL;
		mutex_unlock(&sysmon_lock);
		return;
		}
		pr_info("Connection established between QMI handle and %s's SSCTL service\n"
		@@ -177,6 +180,7 @@ static void sysmon_clnt_svc_arrive(struct work_struct *work)
		if (rc < 0)
		pr_warn("%s: Could not register the indication callback\n",
		data->name);
		mutex_unlock(&sysmon_lock);
		}

		static void sysmon_clnt_svc_exit(struct work_struct *work)
		@@ -184,8 +188,10 @@ static void sysmon_clnt_svc_exit(struct work_struct *work)
		struct sysmon_qmi_data *data = container_of(work,
		struct sysmon_qmi_data, svc_exit);

		mutex_lock(&sysmon_lock);
		qmi_handle_destroy(data->clnt_handle);
		data->clnt_handle = NULL;
		mutex_unlock(&sysmon_lock);
		}

		static void sysmon_clnt_recv_msg(struct work_struct *work)