Merge "diag: dci: Fix possible dangling reference" (6a7e9f8b) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/char/diag/diag_dci.c

+26 −0

Original line number	Diff line number	Diff line
		@@ -768,6 +768,7 @@ static int diag_dci_remove_req_entry(unsigned char *buf, int len,
		if (*buf != 0x80) {
		list_del(&entry->track);
		kfree(entry);
		entry = NULL;
		return 1;
		}

		@@ -785,6 +786,7 @@ static int diag_dci_remove_req_entry(unsigned char *buf, int len,
		if (delayed_rsp_id == 0) {
		list_del(&entry->track);
		kfree(entry);
		entry = NULL;
		return 1;
		}

		@@ -798,6 +800,7 @@ static int diag_dci_remove_req_entry(unsigned char *buf, int len,
		if (rsp_count > 0 && rsp_count < 0x1000) {
		list_del(&entry->track);
		kfree(entry);
		entry = NULL;
		return 1;
		}

		@@ -2611,10 +2614,12 @@ int diag_dci_init(void)
		err:
		pr_err("diag: Could not initialize diag DCI buffers");
		kfree(driver->apps_dci_buf);
		driver->apps_dci_buf = NULL;

		if (driver->diag_dci_wq)
		destroy_workqueue(driver->diag_dci_wq);
		kfree(partial_pkt.data);
		partial_pkt.data = NULL;
		mutex_destroy(&driver->dci_mutex);
		mutex_destroy(&dci_log_mask_mutex);
		mutex_destroy(&dci_event_mask_mutex);
		@@ -2634,7 +2639,9 @@ void diag_dci_channel_init(void)
		void diag_dci_exit(void)
		{
		kfree(partial_pkt.data);
		partial_pkt.data = NULL;
		kfree(driver->apps_dci_buf);
		driver->apps_dci_buf = NULL;
		mutex_destroy(&driver->dci_mutex);
		mutex_destroy(&dci_log_mask_mutex);
		mutex_destroy(&dci_event_mask_mutex);
		@@ -2846,22 +2853,30 @@ fail_alloc:
		mutex_destroy(&proc_buf->health_mutex);
		if (proc_buf->buf_primary) {
		kfree(proc_buf->buf_primary->data);
		proc_buf->buf_primary->data = NULL;
		mutex_destroy(
		&proc_buf->buf_primary->data_mutex);
		}
		kfree(proc_buf->buf_primary);
		proc_buf->buf_primary = NULL;
		if (proc_buf->buf_cmd) {
		kfree(proc_buf->buf_cmd->data);
		proc_buf->buf_cmd->data = NULL;
		mutex_destroy(
		&proc_buf->buf_cmd->data_mutex);
		}
		kfree(proc_buf->buf_cmd);
		proc_buf->buf_cmd = NULL;
		}
		}
		kfree(new_entry->dci_event_mask);
		new_entry->dci_event_mask = NULL;
		kfree(new_entry->dci_log_mask);
		new_entry->dci_log_mask = NULL;
		kfree(new_entry->buffers);
		new_entry->buffers = NULL;
		kfree(new_entry);
		new_entry = NULL;
		}
		mutex_unlock(&driver->dci_mutex);
		return DIAG_DCI_NO_REG;
		@@ -2892,6 +2907,7 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry)
		* masks and send the masks to peripherals
		*/
		kfree(entry->dci_log_mask);
		entry->dci_log_mask = NULL;
		diag_dci_invalidate_cumulative_log_mask(token);
		if (token == DCI_LOCAL_PROC)
		diag_update_userspace_clients(DCI_LOG_MASKS_TYPE);
		@@ -2900,6 +2916,7 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry)
		return ret;
		}
		kfree(entry->dci_event_mask);
		entry->dci_event_mask = NULL;
		diag_dci_invalidate_cumulative_event_mask(token);
		if (token == DCI_LOCAL_PROC)
		diag_update_userspace_clients(DCI_EVENT_MASKS_TYPE);
		@@ -2915,6 +2932,7 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry)
		if (!list_empty(&req_entry->track))
		list_del(&req_entry->track);
		kfree(req_entry);
		req_entry = NULL;
		}
		}

		@@ -2930,6 +2948,7 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry)
		buf_entry->data = NULL;
		mutex_unlock(&buf_entry->data_mutex);
		kfree(buf_entry);
		buf_entry = NULL;
		} else if (buf_entry->buf_type == DCI_BUF_CMD) {
		peripheral = buf_entry->data_source;
		if (peripheral == APPS_DATA)
		@@ -2956,14 +2975,17 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry)
		mutex_unlock(&buf_entry->data_mutex);
		mutex_destroy(&buf_entry->data_mutex);
		kfree(buf_entry);
		buf_entry = NULL;
		}

		mutex_lock(&proc_buf->buf_primary->data_mutex);
		kfree(proc_buf->buf_primary->data);
		proc_buf->buf_primary->data = NULL;
		mutex_unlock(&proc_buf->buf_primary->data_mutex);

		mutex_lock(&proc_buf->buf_cmd->data_mutex);
		kfree(proc_buf->buf_cmd->data);
		proc_buf->buf_cmd->data = NULL;
		mutex_unlock(&proc_buf->buf_cmd->data_mutex);

		mutex_destroy(&proc_buf->health_mutex);
		@@ -2971,13 +2993,17 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry)
		mutex_destroy(&proc_buf->buf_cmd->data_mutex);

		kfree(proc_buf->buf_primary);
		proc_buf->buf_primary = NULL;
		kfree(proc_buf->buf_cmd);
		proc_buf->buf_cmd = NULL;
		mutex_unlock(&proc_buf->buf_mutex);
		}
		mutex_destroy(&entry->write_buf_mutex);

		kfree(entry->buffers);
		entry->buffers = NULL;
		kfree(entry);
		entry = NULL;

		if (driver->num_dci_client == 0) {
		diag_update_proc_vote(DIAG_PROC_DCI, VOTE_DOWN, token);