diff options
| author | Zhen Kong <zkong@codeaurora.org> | 2018-07-13 12:02:32 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-09-11 11:17:37 -0700 |
| commit | 3dc27e3392c582d0f5ad20db3690b122a3a236b1 (patch) | |
| tree | 3b564b3160981a3034c5b950fd77abd74aea7b3f | |
| parent | ecb710876b0d1075be29a1bcb771b42fa5d759bc (diff) | |
qseecom: fix kclient free issue in qseecom_remove
Remove kzfree() after kclient list iteration to avoid invalid
pointer deference.
Change-Id: I78922269e219fcb16d3cff05f8b168a75a3c05ae
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
| -rw-r--r-- | drivers/misc/qseecom.c | 15 |
1 files changed, 5 insertions, 10 deletions
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index f0140e8bbe68..e85b2b8972c9 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -8743,11 +8743,11 @@ static int qseecom_remove(struct platform_device *pdev) &qseecom.registered_kclient_list_head, list) { /* Break the loop if client handle is NULL */ - if (!kclient->handle) - goto exit_free_kclient; - - if (list_empty(&kclient->list)) - goto exit_free_kc_handle; + if (!kclient->handle) { + list_del(&kclient->list); + kzfree(kclient); + break; + } list_del(&kclient->list); mutex_lock(&app_access_lock); @@ -8760,11 +8760,6 @@ static int qseecom_remove(struct platform_device *pdev) } } -exit_free_kc_handle: - kzfree(kclient->handle); -exit_free_kclient: - kzfree(kclient); - spin_unlock_irqrestore(&qseecom.registered_kclient_list_lock, flags); if (qseecom.qseos_version > QSEEE_VERSION_00) |