From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
To: gregkh@linuxfoundation.org, arnd@arndb.de
Cc: linux-kernel@vger.kernel.org, bjorn.andersson@linaro.org,
bkumar@qti.qualcomm.com, linux-arm-msm@vger.kernel.org,
ktadakam@qti.qualcomm.com,
Thierry Escande <thierry.escande@linaro.org>,
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Subject: [PATCH 2/8] misc: fastrpc: Fix a possible double free
Date: Thu, 7 Mar 2019 10:12:23 +0000 [thread overview]
Message-ID: <20190307101229.7856-3-srinivas.kandagatla@linaro.org> (raw)
In-Reply-To: <20190307101229.7856-1-srinivas.kandagatla@linaro.org>
From: Thierry Escande <thierry.escande@linaro.org>
This patch fixes the error exit path of fastrpc_init_create_process().
If the DMA allocation or the DSP invoke fails the fastrpc_map was freed
but not removed from the mapping list leading to a double free once the
mapping list is emptied in fastrpc_device_release().
[srinivas kandagatla]: Cleaned up error path labels and reset init mem
to NULL after free
Fixes: d73f71c7c6ee("misc: fastrpc: Add support for create remote init process")
Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
drivers/misc/fastrpc.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 82e7217ae87a..8fbcc607a77e 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -853,12 +853,12 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
if (copy_from_user(&init, argp, sizeof(init))) {
err = -EFAULT;
- goto bail;
+ goto err;
}
if (init.filelen > INIT_FILELEN_MAX) {
err = -EINVAL;
- goto bail;
+ goto err;
}
inbuf.pgid = fl->tgid;
@@ -872,17 +872,15 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
if (init.filelen && init.filefd) {
err = fastrpc_map_create(fl, init.filefd, init.filelen, &map);
if (err)
- goto bail;
+ goto err;
}
memlen = ALIGN(max(INIT_FILELEN_MAX, (int)init.filelen * 4),
1024 * 1024);
err = fastrpc_buf_alloc(fl, fl->sctx->dev, memlen,
&imem);
- if (err) {
- fastrpc_map_put(map);
- goto bail;
- }
+ if (err)
+ goto err_alloc;
fl->init_mem = imem;
args[0].ptr = (u64)(uintptr_t)&inbuf;
@@ -918,13 +916,24 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
sc, args);
+ if (err)
+ goto err_invoke;
- if (err) {
+ kfree(args);
+
+ return 0;
+
+err_invoke:
+ fl->init_mem = NULL;
+ fastrpc_buf_free(imem);
+err_alloc:
+ if (map) {
+ spin_lock(&fl->lock);
+ list_del(&map->node);
+ spin_unlock(&fl->lock);
fastrpc_map_put(map);
- fastrpc_buf_free(imem);
}
-
-bail:
+err:
kfree(args);
return err;
--
2.21.0
next prev parent reply other threads:[~2019-03-07 10:14 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-07 10:12 [PATCH 0/8] misc: fastrpc: few fixes Srinivas Kandagatla
2019-03-07 10:12 ` [PATCH 1/8] misc: fastrpc: Avoid free of DMA buffer in interrupt context Srinivas Kandagatla
2019-03-07 10:12 ` Srinivas Kandagatla [this message]
2019-03-07 10:12 ` [PATCH 3/8] misc: fastrpc: make sure memory read and writes are visible Srinivas Kandagatla
2019-03-07 10:12 ` [PATCH 4/8] misc: fastrpc: use correct spinlock variant Srinivas Kandagatla
2019-03-07 10:12 ` [PATCH 5/8] misc: fastrpc: consider address offset before sending to DSP Srinivas Kandagatla
2019-03-07 10:12 ` [PATCH 6/8] misc: fastrpc: take into account of overlapping buffers Srinivas Kandagatla
2019-03-07 10:12 ` [PATCH 7/8] misc: fastrpc: fix remote page size calculation Srinivas Kandagatla
2019-03-07 10:12 ` [PATCH 8/8] misc: fastrpc: increase max init file size to 64 MB Srinivas Kandagatla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190307101229.7856-3-srinivas.kandagatla@linaro.org \
--to=srinivas.kandagatla@linaro.org \
--cc=arnd@arndb.de \
--cc=bjorn.andersson@linaro.org \
--cc=bkumar@qti.qualcomm.com \
--cc=gregkh@linuxfoundation.org \
--cc=ktadakam@qti.qualcomm.com \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=thierry.escande@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).