Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 38afda62 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm:ipa: Fix to kasan use-after-free issue"

parents 4db0f87a 2f0435a9

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+5 −1
Original line number Original line Diff line number Diff line
@@ -857,12 +857,16 @@ int ipa2_query_rt_index(struct ipa_ioc_get_rt_tbl_indx *in) 
		return -EINVAL;

		return -EINVAL;

	}

	}





	mutex_lock(&ipa_ctx->lock);

	/* check if this table exists */

	/* check if this table exists */

	entry = __ipa_find_rt_tbl(in->ip, in->name);

	entry = __ipa_find_rt_tbl(in->ip, in->name);

	if (!entry)

	if (!entry) {

		mutex_unlock(&ipa_ctx->lock);

		return -EFAULT;

		return -EFAULT;

	}





	in->idx  = entry->idx;

	in->idx  = entry->idx;

	mutex_unlock(&ipa_ctx->lock);

	return 0;

	return 0;

}

}

drivers/platform/msm/ipa/ipa_v3/ipa_rt.c

+5 −2
Original line number Original line Diff line number Diff line
@@ -901,12 +901,15 @@ int ipa3_query_rt_index(struct ipa_ioc_get_rt_tbl_indx *in) 
		return -EINVAL;

		return -EINVAL;

	}

	}





	mutex_lock(&ipa3_ctx->lock);

	/* check if this table exists */

	/* check if this table exists */

	entry = __ipa3_find_rt_tbl(in->ip, in->name);

	entry = __ipa3_find_rt_tbl(in->ip, in->name);

	if (!entry)

	if (!entry) {

		mutex_unlock(&ipa3_ctx->lock);

		return -EFAULT;

		return -EFAULT;



	}

	in->idx  = entry->idx;

	in->idx  = entry->idx;

	mutex_unlock(&ipa3_ctx->lock);

	return 0;

	return 0;

}

}