Commit b49f6d83 authored by Thierry Escande's avatar Thierry Escande Committed by Greg Kroah-Hartman

misc: fastrpc: Fix a possible double free

This patch fixes the error exit path of fastrpc_init_create_process().
If the DMA allocation or the DSP invoke fails the fastrpc_map was freed
but not removed from the mapping list leading to a double free once the
mapping list is emptied in fastrpc_device_release().

[srinivas kandagatla]: Cleaned up error path labels and reset init mem
to NULL after free
Fixes: d73f71c7("misc: fastrpc: Add support for create remote init process")
Signed-off-by: default avatarThierry Escande <thierry.escande@linaro.org>
Signed-off-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8e7389c7
...@@ -853,12 +853,12 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, ...@@ -853,12 +853,12 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
if (copy_from_user(&init, argp, sizeof(init))) { if (copy_from_user(&init, argp, sizeof(init))) {
err = -EFAULT; err = -EFAULT;
goto bail; goto err;
} }
if (init.filelen > INIT_FILELEN_MAX) { if (init.filelen > INIT_FILELEN_MAX) {
err = -EINVAL; err = -EINVAL;
goto bail; goto err;
} }
inbuf.pgid = fl->tgid; inbuf.pgid = fl->tgid;
...@@ -872,17 +872,15 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, ...@@ -872,17 +872,15 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
if (init.filelen && init.filefd) { if (init.filelen && init.filefd) {
err = fastrpc_map_create(fl, init.filefd, init.filelen, &map); err = fastrpc_map_create(fl, init.filefd, init.filelen, &map);
if (err) if (err)
goto bail; goto err;
} }
memlen = ALIGN(max(INIT_FILELEN_MAX, (int)init.filelen * 4), memlen = ALIGN(max(INIT_FILELEN_MAX, (int)init.filelen * 4),
1024 * 1024); 1024 * 1024);
err = fastrpc_buf_alloc(fl, fl->sctx->dev, memlen, err = fastrpc_buf_alloc(fl, fl->sctx->dev, memlen,
&imem); &imem);
if (err) { if (err)
fastrpc_map_put(map); goto err_alloc;
goto bail;
}
fl->init_mem = imem; fl->init_mem = imem;
args[0].ptr = (u64)(uintptr_t)&inbuf; args[0].ptr = (u64)(uintptr_t)&inbuf;
...@@ -918,13 +916,24 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, ...@@ -918,13 +916,24 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
sc, args); sc, args);
if (err)
goto err_invoke;
if (err) { kfree(args);
return 0;
err_invoke:
fl->init_mem = NULL;
fastrpc_buf_free(imem);
err_alloc:
if (map) {
spin_lock(&fl->lock);
list_del(&map->node);
spin_unlock(&fl->lock);
fastrpc_map_put(map); fastrpc_map_put(map);
fastrpc_buf_free(imem);
} }
err:
bail:
kfree(args); kfree(args);
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment