mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-21 10:01:00 +00:00
misc: fastrpc: Fix double free of 'buf' in error path
commite8c276d4dc
upstream. smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf' In fastrpc_req_mmap() error path, the fastrpc buffer is freed in fastrpc_req_munmap_impl() if unmap is successful. But in the end, there is an unconditional call to fastrpc_buf_free(). So the above case triggers the double free of fastrpc buf. Fixes:72fa6f7820
("misc: fastrpc: Rework fastrpc_req_munmap") Reviewed-by: Shuah Khan <skhan@linuxfoundation.org> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Sukrut Bellary <sukrut.bellary@linux.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Cc: stable <stable@kernel.org> Link: https://lore.kernel.org/r/20240902141409.70371-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
7d301dd272
commit
f77dc8a758
1 changed files with 2 additions and 3 deletions
|
@ -1912,7 +1912,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
|
|||
&args[0]);
|
||||
if (err) {
|
||||
dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
|
||||
goto err_invoke;
|
||||
fastrpc_buf_free(buf);
|
||||
return err;
|
||||
}
|
||||
|
||||
/* update the buffer to be able to deallocate the memory on the DSP */
|
||||
|
@ -1950,8 +1951,6 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
|
|||
|
||||
err_assign:
|
||||
fastrpc_req_munmap_impl(fl, buf);
|
||||
err_invoke:
|
||||
fastrpc_buf_free(buf);
|
||||
|
||||
return err;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue