evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

soc: qcom: glink_ssr: Set NULL after free

Browse source 
In function close_ch_worker variable ss_info->cb_data is not set to
NULL after free, this results in crash due to  use after free in
notify_for_subsystem function.

This variable is set to NULL to avoid any crash due to use after free.

CRs-Fixed: 2000384
Change-Id: Ia0c7b52e4c8f5d0215fd0ebfbca5e823530f205c
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
This commit is contained in:
Dhoat Harpal 2017-02-01 20:16:21 +05:30
parent af883d4db0
commit 4513fe91d7
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/soc/qcom/glink_ssr.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. /* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -339,6 +339,7 @@ void close_ch_worker(struct work_struct *work)
BUG_ON(!ss_info->cb_data); BUG_ON(!ss_info->cb_data);
kfree(ss_info->cb_data); kfree(ss_info->cb_data);
ss_info->cb_data = NULL;
kfree(close_work); kfree(close_work);
} }