diff options
| author | Utkarsh Saxena <usaxena@codeaurora.org> | 2017-04-03 13:21:58 +0530 |
|---|---|---|
| committer | Utkarsh Saxena <usaxena@codeaurora.org> | 2017-04-04 12:19:57 +0530 |
| commit | d13d6d68938959fcffaa7dafec0f442021573fe2 (patch) | |
| tree | 919d6e282a30155ee66871aed23f8b450153c151 | |
| parent | 44f5f07cfca714fa0d1b68a8f3d0f87d80a62074 (diff) | |
msm: ipa: Fix memory leak in ipa driver
Free the memory pointed by msg pointer if
copy_to_user fails.
Change-Id: I628e089d844a3e1818a1a550e77ac10f33640ac9
Acked-by: Mohammed Javid <mjavid@qti.qualcomm.com>
Signed-off-by: Utkarsh Saxena <usaxena@codeaurora.org>
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v2/ipa_intf.c | 4 | ||||
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v3/ipa_intf.c | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/drivers/platform/msm/ipa/ipa_v2/ipa_intf.c b/drivers/platform/msm/ipa/ipa_v2/ipa_intf.c index f8f8fd12161a..5c07bc7d43b5 100644 --- a/drivers/platform/msm/ipa/ipa_v2/ipa_intf.c +++ b/drivers/platform/msm/ipa/ipa_v2/ipa_intf.c @@ -562,6 +562,8 @@ ssize_t ipa_read(struct file *filp, char __user *buf, size_t count, mutex_unlock(&ipa_ctx->msg_lock); if (copy_to_user(buf, &msg->meta, sizeof(struct ipa_msg_meta))) { + kfree(msg); + msg = NULL; ret = -EFAULT; break; } @@ -570,6 +572,8 @@ ssize_t ipa_read(struct file *filp, char __user *buf, size_t count, if (msg->buff) { if (copy_to_user(buf, msg->buff, msg->meta.msg_len)) { + kfree(msg); + msg = NULL; ret = -EFAULT; break; } diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c b/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c index b687b711dc20..16a567644f79 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c @@ -572,6 +572,8 @@ ssize_t ipa3_read(struct file *filp, char __user *buf, size_t count, if (copy_to_user(buf, &msg->meta, sizeof(struct ipa_msg_meta))) { ret = -EFAULT; + kfree(msg); + msg = NULL; break; } buf += sizeof(struct ipa_msg_meta); @@ -580,6 +582,8 @@ ssize_t ipa3_read(struct file *filp, char __user *buf, size_t count, if (copy_to_user(buf, msg->buff, msg->meta.msg_len)) { ret = -EFAULT; + kfree(msg); + msg = NULL; break; } buf += msg->meta.msg_len; |