lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipa: Null persistent pointers after free

Browse Source 
Assign NULL to pointers that may be used later
after calling kfree on them.

Change-Id: I3298eb484c92ee2373f0bc41aae8ae45fb373cf0
Signed-off-by: Ilia Lin <ilialin@codeaurora.org>
This commit is contained in:
Ilia Lin 2021-08-26 11:14:33 +03:00
parent 86100918ae
commit ccad254cc1
7 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/platform/msm/ipa/ipa_clients/ipa_uc_offload.c
View File

@ -356,6 +356,7 @@ static int ipa_uc_ntn_alloc_conn_smmu_info(struct ipa_ntn_setup_info *dest,
source->buff_pool_base_sgt);
if (result) {
kfree(dest->data_buff_list);
dest->data_buff_list = NULL;
return result;
}
@ -363,6 +364,7 @@ static int ipa_uc_ntn_alloc_conn_smmu_info(struct ipa_ntn_setup_info *dest,
source->ring_base_sgt);
if (result) {
kfree(dest->data_buff_list);
dest->data_buff_list = NULL;
ipa_smmu_free_sgt(&dest->buff_pool_base_sgt);
return result;
}
@ -373,6 +375,7 @@ static int ipa_uc_ntn_alloc_conn_smmu_info(struct ipa_ntn_setup_info *dest,
static void ipa_uc_ntn_free_conn_smmu_info(struct ipa_ntn_setup_info *params)
{
kfree(params->data_buff_list);
params->data_buff_list = NULL;
ipa_smmu_free_sgt(&params->buff_pool_base_sgt);
ipa_smmu_free_sgt(&params->ring_base_sgt);
}

5
drivers/platform/msm/ipa/ipa_v3/ipa.c
View File

@ -689,6 +689,7 @@ static void ipa3_active_clients_log_destroy(void)
kfree(active_clients_table_buf);
active_clients_table_buf = NULL;
kfree(ipa3_ctx->ipa3_active_clients_logging.log_buffer[0]);
ipa3_ctx->ipa3_active_clients_logging.log_buffer[0] = NULL;
ipa3_ctx->ipa3_active_clients_logging.log_head = 0;
ipa3_ctx->ipa3_active_clients_logging.log_tail =
IPA3_ACTIVE_CLIENTS_LOG_BUFFER_SIZE_LINES - 1;
@ -7867,13 +7868,16 @@ fail_bus_reg:
fail_init_mem_partition:
fail_bind:
kfree(ipa3_ctx->ctrl);
ipa3_ctx->ctrl = NULL;
fail_mem_ctrl:
kfree(ipa3_ctx->ipa_tz_unlock_reg);
ipa3_ctx->ipa_tz_unlock_reg = NULL;
fail_tz_unlock_reg:
if (ipa3_ctx->logbuf)
ipc_log_context_destroy(ipa3_ctx->logbuf);
fail_uc_file_alloc:
kfree(ipa3_ctx->gsi_fw_file_name);
ipa3_ctx->gsi_fw_file_name = NULL;
fail_gsi_file_alloc:
fail_mem_ctx:
return result;
@ -8561,6 +8565,7 @@ static int get_ipa_dts_configuration(struct platform_device *pdev,
IPAERR("failed to read register addresses\n");
kfree(ipa_tz_unlock_reg);
kfree(ipa_drv_res->ipa_tz_unlock_reg);
ipa_drv_res->ipa_tz_unlock_reg = NULL;
return -EFAULT;
}

4
drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
View File

@ -1383,10 +1383,12 @@ fail_repl:
ep->sys->repl_hdlr = ipa3_replenish_rx_cache;
ep->sys->repl->capacity = 0;
kfree(ep->sys->repl);
ep->sys->repl = NULL;
fail_page_recycle_repl:
if (ep->sys->page_recycle_repl) {
ep->sys->page_recycle_repl->capacity = 0;
kfree(ep->sys->page_recycle_repl);
ep->sys->page_recycle_repl = NULL;
}
fail_napi:
/* Delete NAPI TX object. */
@ -2827,6 +2829,7 @@ static void ipa3_cleanup_rx(struct ipa3_sys_context *sys)
kfree(sys->repl->cache);
kfree(sys->repl);
sys->repl = NULL;
}
if (sys->page_recycle_repl) {
for (i = 0; i < sys->page_recycle_repl->capacity; i++) {
@ -2845,6 +2848,7 @@ static void ipa3_cleanup_rx(struct ipa3_sys_context *sys)
}
kfree(sys->page_recycle_repl->cache);
kfree(sys->page_recycle_repl);
sys->page_recycle_repl = NULL;
}
}

1
drivers/platform/msm/ipa/ipa_v3/ipa_odl.c
View File

@ -762,6 +762,7 @@ alloc_chrdev0_region_fail:
class_destroy(odl_cdev[0].class);
create_char_dev0_fail:
kfree(ipa3_odl_ctx);
ipa3_odl_ctx = NULL;
fail_mem_ctx:
return result;
}

1
drivers/platform/msm/ipa/ipa_v3/ipa_pm.c
View File

@ -641,6 +641,7 @@ int ipa_pm_init(struct ipa_pm_init_params *params)
if (!ipa_pm_ctx->wq) {
IPA_PM_ERR("create workqueue failed\n");
kfree(ipa_pm_ctx);
ipa_pm_ctx = NULL;
return -ENOMEM;
}

3
drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c
View File

@ -742,6 +742,7 @@ static void ipa_release_ap_smmu_mappings(enum ipa_client_type client)
ipa3_ctx->wdi_map_cnt--;
}
kfree(wdi_res[i].res);
wdi_res[i].res = NULL;
wdi_res[i].valid = false;
}
}
@ -778,6 +779,7 @@ static void ipa_release_uc_smmu_mappings(enum ipa_client_type client)
ipa3_ctx->wdi_map_cnt--;
}
kfree(wdi_res[i].res);
wdi_res[i].res = NULL;
wdi_res[i].valid = false;
}
}
@ -929,6 +931,7 @@ void ipa3_release_wdi3_gsi_smmu_mappings(u8 dir)
ipa3_ctx->wdi_map_cnt--;
}
kfree(wdi_res[i].res);
wdi_res[i].res = NULL;
wdi_res[i].valid = false;
}
}

1
drivers/platform/msm/ipa/ipa_v3/rmnet_ctl_ipa.c
View File

@ -103,6 +103,7 @@ int ipa3_rmnet_ctl_init(void)
WQ_MEM_RECLAIM | WQ_UNBOUND | WQ_SYSFS, 1);
if (!rmnet_ctl_ipa3_ctx->wq) {
kfree(rmnet_ctl_ipa3_ctx);
rmnet_ctl_ipa3_ctx = NULL;
return -ENOMEM;
}
memset(&rmnet_ctl_ipa3_ctx->apps_to_ipa_low_lat_ep_cfg, 0,