Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9996a253 authored by Nadine Toledano's avatar Nadine Toledano
Browse files

msm: ipa3: fix reading from released memory in ipadma 



In ipa_dma_sync_memcopy memory released before checking its value.
changing the order - reading the value and then
releasing the memory.

Change-Id: Id29ecb35134e4c041661c2f7dd5924dbfa5d596d
Signed-off-by: default avatarNadine Toledano <nadinet@codeaurora.org>
parent bb29ea15

drivers/platform/msm/ipa/ipa_v3/ipa_dma.c

+10 −8
Original line number Original line Diff line number Diff line
@@ -499,6 +499,15 @@ int ipa3_dma_sync_memcpy(u64 dest, u64 src, int len) 
		i++;

		i++;

	} while (!stop_polling);

	} while (!stop_polling);





	if (ipa3_ctx->transport_prototype == IPA_TRANSPORT_TYPE_GSI) {

		BUG_ON(len != gsi_notify.bytes_xfered);

		BUG_ON(dest != ((struct ipa3_dma_xfer_wrapper *)

				(gsi_notify.xfer_user_data))->phys_addr_dest);

	} else {

		BUG_ON(dest != iov.addr);

		BUG_ON(len != iov.size);

	}



	mutex_lock(&ipa3_dma_ctx->sync_lock);

	mutex_lock(&ipa3_dma_ctx->sync_lock);

	list_del(&head_descr->link);

	list_del(&head_descr->link);

	cons_sys->len--;

	cons_sys->len--;
@@ -510,14 +519,7 @@ int ipa3_dma_sync_memcpy(u64 dest, u64 src, int len) 
		complete(&head_descr->xfer_done);

		complete(&head_descr->xfer_done);

	}

	}

	mutex_unlock(&ipa3_dma_ctx->sync_lock);

	mutex_unlock(&ipa3_dma_ctx->sync_lock);

	if (ipa3_ctx->transport_prototype == IPA_TRANSPORT_TYPE_GSI) {



		BUG_ON(len != gsi_notify.bytes_xfered);

		BUG_ON(dest != ((struct ipa3_dma_xfer_wrapper *)

				(gsi_notify.xfer_user_data))->phys_addr_dest);

	} else {

		BUG_ON(dest != iov.addr);

		BUG_ON(len != iov.size);

	}

	atomic_inc(&ipa3_dma_ctx->total_sync_memcpy);

	atomic_inc(&ipa3_dma_ctx->total_sync_memcpy);

	atomic_dec(&ipa3_dma_ctx->sync_memcpy_pending_cnt);

	atomic_dec(&ipa3_dma_ctx->sync_memcpy_pending_cnt);

	if (ipa3_dma_ctx->destroy_pending && !ipa3_dma_work_pending())

	if (ipa3_dma_ctx->destroy_pending && !ipa3_dma_work_pending())