Commit 3b6971be authored Aug 07, 2017 by Mohammed Javid Committed by Gerrit - the friendly Code Review server Oct 23, 2017

msm: ipa: Fix to use after free issue



Added to code changes to ref_cnt variable will decrement only
when add_ref_hdr variable is true.

Change-Id: I0bcc3909669f4843c43135e5f047ac28fa62bb63
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>

parent 3ce4bd68

drivers/platform/msm/ipa/ipa_hdr.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -569,6 +569,7 @@ ipa_insert_failed:
		list_del(&entry->link);
		htbl->proc_ctx_cnt--;
		bad_len:
		if (add_ref_hdr)
		hdr_entry->ref_cnt--;
		entry->cookie = 0;
		kmem_cache_free(ipa_ctx->hdr_proc_ctx_cache, entry);