evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

diag: Remove null pointer dereference from diag_md_session_close

Browse source 
Remove reference to session_info after handle is closed.
Store the peripheral masks in a local variable before closing the
session. Use stored value instead of closed session_info handle.

CRs-fixed: 930676
Change-Id: I08179b100926883f0cb84e0de35cc356e9cc9a03
Signed-off-by: Chris Lew <clew@codeaurora.org>
This commit is contained in:
Chris Lew 2015-12-01 17:24:53 -08:00 • committed by David Keitel
parent ed24b051c7
commit 8f029e767b
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/char/diag/diagchar_core.c
View file

@ -372,6 +372,7 @@ fail:
static void diag_close_logging_process(const int pid) static void diag_close_logging_process(const int pid)
{ {
int i; int i;
int session_peripheral_mask;
struct diag_md_session_t *session_info = NULL; struct diag_md_session_t *session_info = NULL;
struct diag_logging_mode_param_t params; struct diag_logging_mode_param_t params;
@ -379,9 +380,10 @@ static void diag_close_logging_process(const int pid)
if (!session_info) if (!session_info)
return; return;
session_peripheral_mask = session_info->peripheral_mask;
diag_md_session_close(session_info); diag_md_session_close(session_info);
for (i = 0; i < NUM_MD_SESSIONS; i++) for (i = 0; i < NUM_MD_SESSIONS; i++)
if (MD_PERIPHERAL_MASK(i) & session_info->peripheral_mask) if (MD_PERIPHERAL_MASK(i) & session_peripheral_mask)
diag_mux_close_peripheral(DIAG_LOCAL_PROC, i); diag_mux_close_peripheral(DIAG_LOCAL_PROC, i);
params.req_mode = USB_MODE; params.req_mode = USB_MODE;