Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 10773997 authored Apr 03, 2017 by Utkarsh Saxena Committed by Gerrit - the friendly Code Review server Apr 10, 2017

msm: ipa: Fix memory leak in ipa driver



Free the memory pointed by msg pointer if
copy_to_user fails.

Change-Id: I628e089d844a3e1818a1a550e77ac10f33640ac9
Acked-by: Mohammed Javid <mjavid@qti.qualcomm.com>
Signed-off-by: Utkarsh Saxena <usaxena@codeaurora.org>

parent e29926e9

drivers/platform/msm/ipa/ipa_v2/ipa_intf.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -562,6 +562,8 @@ ssize_t ipa_read(struct file filp, char __user buf, size_t count,
		mutex_unlock(&ipa_ctx->msg_lock);
		if (copy_to_user(buf, &msg->meta,
		sizeof(struct ipa_msg_meta))) {
		kfree(msg);
		msg = NULL;
		ret = -EFAULT;
		break;
		}
		@@ -570,6 +572,8 @@ ssize_t ipa_read(struct file filp, char __user buf, size_t count,
		if (msg->buff) {
		if (copy_to_user(buf, msg->buff,
		msg->meta.msg_len)) {
		kfree(msg);
		msg = NULL;
		ret = -EFAULT;
		break;
		}

drivers/platform/msm/ipa/ipa_v3/ipa_intf.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -570,6 +570,8 @@ ssize_t ipa3_read(struct file filp, char __user buf, size_t count,
		if (copy_to_user(buf, &msg->meta,
		sizeof(struct ipa_msg_meta))) {
		ret = -EFAULT;
		kfree(msg);
		msg = NULL;
		break;
		}
		buf += sizeof(struct ipa_msg_meta);
		@@ -578,6 +580,8 @@ ssize_t ipa3_read(struct file filp, char __user buf, size_t count,
		if (copy_to_user(buf, msg->buff,
		msg->meta.msg_len)) {
		ret = -EFAULT;
		kfree(msg);
		msg = NULL;
		break;
		}
		buf += msg->meta.msg_len;