Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e74efda authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu Committed by Gerrit - the friendly Code Review server
Browse files

msm: adsprpc: destroy mutex before file free 



Destroy mutex before file free, to avoid use after free of mutex.

Change-Id: I4ff73dc17b15043eacbb299219a379bfd1a8efa6
Acked-by: default avatarHimateja Reddy <hmreddy@qti.qualcomm.com>
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 829d7d99

drivers/char/adsprpc.c

+1 −1
Original line number Diff line number Diff line
@@ -1858,6 +1858,7 @@ static int fastrpc_file_free(struct fastrpc_file *fl) 
	if (fl->ssrcount == fl->apps->channel[cid].ssrcount)

		kref_put_mutex(&fl->apps->channel[cid].kref,

				fastrpc_channel_close, &fl->apps->smd_mutex);

	mutex_destroy(&fl->map_mutex);

	kfree(fl);

	return 0;

}
@@ -2011,7 +2012,6 @@ static int fastrpc_device_release(struct inode *inode, struct file *file) 
		}

		me->pending_free++;

		mutex_unlock(&me->flfree_mutex);

		mutex_destroy(&fl->map_mutex);

		file->private_data = NULL;

	}

bail: