diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-06-23 05:56:37 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-06-23 05:56:37 -0700 |
| commit | 8e102f05a2a40075a8f166fc33143424ee1ae708 (patch) | |
| tree | 3c21b3982420c94c723349b3cbfb7cdf05b09929 /drivers/platform | |
| parent | e965ee522699be8323c0697a1c174b7e6ca10c6f (diff) | |
| parent | a950cd0068fbad7dd594d4b95411cfc3279c225a (diff) | |
Merge "msm:ipa: Fix to kasan use-after-free issue"
Diffstat (limited to 'drivers/platform')
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v2/ipa_rt.c | 6 | ||||
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v3/ipa_rt.c | 7 |
2 files changed, 10 insertions, 3 deletions
diff --git a/drivers/platform/msm/ipa/ipa_v2/ipa_rt.c b/drivers/platform/msm/ipa/ipa_v2/ipa_rt.c index 2214dfe89df3..f2909110d09f 100644 --- a/drivers/platform/msm/ipa/ipa_v2/ipa_rt.c +++ b/drivers/platform/msm/ipa/ipa_v2/ipa_rt.c @@ -857,12 +857,16 @@ int ipa2_query_rt_index(struct ipa_ioc_get_rt_tbl_indx *in) return -EINVAL; } + mutex_lock(&ipa_ctx->lock); /* check if this table exists */ entry = __ipa_find_rt_tbl(in->ip, in->name); - if (!entry) + if (!entry) { + mutex_unlock(&ipa_ctx->lock); return -EFAULT; + } in->idx = entry->idx; + mutex_unlock(&ipa_ctx->lock); return 0; } diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c index 7212ba2a165c..6197c9f64ca5 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c @@ -727,12 +727,15 @@ int ipa3_query_rt_index(struct ipa_ioc_get_rt_tbl_indx *in) return -EINVAL; } + mutex_lock(&ipa3_ctx->lock); /* check if this table exists */ entry = __ipa3_find_rt_tbl(in->ip, in->name); - if (!entry) + if (!entry) { + mutex_unlock(&ipa3_ctx->lock); return -EFAULT; - + } in->idx = entry->idx; + mutex_unlock(&ipa3_ctx->lock); return 0; } |