evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: ipa: Fix memory leak in ipa driver"

Browse source
This commit is contained in:
Linux Build Service Account 2017-04-07 06:39:28 -07:00 • committed by Gerrit - the friendly Code Review server
commit 0eb82372dc
2 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/platform/msm/ipa/ipa_v2/ipa_intf.c
View file

@ -562,6 +562,8 @@ ssize_t ipa_read(struct file *filp, char __user *buf, size_t count,
mutex_unlock(&ipa_ctx->msg_lock); mutex_unlock(&ipa_ctx->msg_lock);
if (copy_to_user(buf, &msg->meta, if (copy_to_user(buf, &msg->meta,
sizeof(struct ipa_msg_meta))) { sizeof(struct ipa_msg_meta))) {
kfree(msg);
msg = NULL;
ret = -EFAULT; ret = -EFAULT;
break; break;
} }
@ -570,6 +572,8 @@ ssize_t ipa_read(struct file *filp, char __user *buf, size_t count,
if (msg->buff) { if (msg->buff) {
if (copy_to_user(buf, msg->buff, if (copy_to_user(buf, msg->buff,
msg->meta.msg_len)) { msg->meta.msg_len)) {
kfree(msg);
msg = NULL;
ret = -EFAULT; ret = -EFAULT;
break; break;
} }

4
drivers/platform/msm/ipa/ipa_v3/ipa_intf.c
View file

@ -572,6 +572,8 @@ ssize_t ipa3_read(struct file *filp, char __user *buf, size_t count,
if (copy_to_user(buf, &msg->meta, if (copy_to_user(buf, &msg->meta,
sizeof(struct ipa_msg_meta))) { sizeof(struct ipa_msg_meta))) {
ret = -EFAULT; ret = -EFAULT;
kfree(msg);
msg = NULL;
break; break;
} }
buf += sizeof(struct ipa_msg_meta); buf += sizeof(struct ipa_msg_meta);
@ -580,6 +582,8 @@ ssize_t ipa3_read(struct file *filp, char __user *buf, size_t count,
if (copy_to_user(buf, msg->buff, if (copy_to_user(buf, msg->buff,
msg->meta.msg_len)) { msg->meta.msg_len)) {
ret = -EFAULT; ret = -EFAULT;
kfree(msg);
msg = NULL;
break; break;
} }
buf += msg->meta.msg_len; buf += msg->meta.msg_len;