Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c11be388 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ipa: Fix use after free issue"

parents 593e4250 006a5f61

drivers/platform/msm/ipa/ipa_v2/ipa.c

+5 −2
Original line number Diff line number Diff line
@@ -538,6 +538,7 @@ static int ipa_send_wan_msg(unsigned long usr_param, 
	int retval;

	struct ipa_wan_msg *wan_msg;

	struct ipa_msg_meta msg_meta;

	struct ipa_wan_msg cache_wan_msg;



	wan_msg = kzalloc(sizeof(struct ipa_wan_msg), GFP_KERNEL);

	if (!wan_msg) {
@@ -551,6 +552,8 @@ static int ipa_send_wan_msg(unsigned long usr_param, 
		return -EFAULT;

	}



	memcpy(&cache_wan_msg, wan_msg, sizeof(cache_wan_msg));



	memset(&msg_meta, 0, sizeof(struct ipa_msg_meta));

	msg_meta.msg_type = msg_type;

	msg_meta.msg_len = sizeof(struct ipa_wan_msg);
@@ -567,8 +570,8 @@ static int ipa_send_wan_msg(unsigned long usr_param, 
		/* cache the cne event */

		memcpy(&ipa_ctx->ipa_cne_evt_req_cache[

			ipa_ctx->num_ipa_cne_evt_req].wan_msg,

			wan_msg,

			sizeof(struct ipa_wan_msg));

			&cache_wan_msg,

			sizeof(cache_wan_msg));



		memcpy(&ipa_ctx->ipa_cne_evt_req_cache[

			ipa_ctx->num_ipa_cne_evt_req].msg_meta,

drivers/platform/msm/ipa/ipa_v3/ipa.c

+5 −2
Original line number Diff line number Diff line
@@ -604,6 +604,7 @@ static int ipa3_send_wan_msg(unsigned long usr_param, 
	int retval;

	struct ipa_wan_msg *wan_msg;

	struct ipa_msg_meta msg_meta;

	struct ipa_wan_msg cache_wan_msg;



	wan_msg = kzalloc(sizeof(struct ipa_wan_msg), GFP_KERNEL);

	if (!wan_msg) {
@@ -617,6 +618,8 @@ static int ipa3_send_wan_msg(unsigned long usr_param, 
		return -EFAULT;

	}



	memcpy(&cache_wan_msg, wan_msg, sizeof(cache_wan_msg));



	memset(&msg_meta, 0, sizeof(struct ipa_msg_meta));

	msg_meta.msg_type = msg_type;

	msg_meta.msg_len = sizeof(struct ipa_wan_msg);
@@ -633,8 +636,8 @@ static int ipa3_send_wan_msg(unsigned long usr_param, 
		/* cache the cne event */

		memcpy(&ipa3_ctx->ipa_cne_evt_req_cache[

			ipa3_ctx->num_ipa_cne_evt_req].wan_msg,

			wan_msg,

			sizeof(struct ipa_wan_msg));

			&cache_wan_msg,

			sizeof(cache_wan_msg));



		memcpy(&ipa3_ctx->ipa_cne_evt_req_cache[

			ipa3_ctx->num_ipa_cne_evt_req].msg_meta,