msm: ipa3: fix the Use-after-free in ipa3_dma_destroy



Move the kfree of ipa3_dma_ctx after finishing the
accessing during clean-up.

Change-Id: Ic7c82fd083ecab069e71b4ba21b04dc88cf9dbad
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>

parent 28c1f5d2

drivers/platform/msm/ipa/ipa_v3/ipa_dma.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1020,10 +1020,10 @@ void ipa3_dma_destroy(void)

		ipa3_dma_debugfs_destroy();
		kmem_cache_destroy(ipa3_dma_ctx->ipa_dma_xfer_wrapper_cache);
		kfree(ipa3_dma_ctx);
		dma_free_coherent(ipa3_ctx->pdev, IPA_DMA_DUMMY_BUFF_SZ * 4,
		ipa3_dma_ctx->ipa_dma_dummy_src_sync.base,
		ipa3_dma_ctx->ipa_dma_dummy_src_sync.phys_base);
		kfree(ipa3_dma_ctx);
		ipa3_dma_ctx = NULL;

		IPADMA_FUNC_EXIT();