samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Förgrening 0
Kod Ärenden Pull-förfrågningar Actions Packages Projekt Släpp Wiki Aktiviteter

soc: swr-mstr: Fix KW issue in swrm_remove

Bläddra i källkod 
Irq pointer is first freed and then used in
irq_set_trigger_type and set wakeup capable.
This may lead to Null pointer dereference if
irq is NULL. Free irq after using it.

Change-Id: I86339e9995922cc8111f12593eb781226bb07a2a
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
This commit is contained in:
Vatsal Bucha
2020-06-18 08:57:27 +05:30
förälder 06ed8063cd
incheckning 269c76b335
1 ändrade filer med 6 tillägg och 6 borttagningar
Download Patch File Download Diff File Expand all files Collapse all files

12
soc/swr-mstr-ctrl.c
Visa fil

@@ -2727,13 +2727,13 @@ err_mstr_fail:
swrm->reg_irq(swrm->handle, swr_mstr_interrupt, swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
swrm, SWR_IRQ_FREE); swrm, SWR_IRQ_FREE);
} else if (swrm->irq) { } else if (swrm->irq) {
free_irq(swrm->irq, swrm);
irqd_set_trigger_type( irqd_set_trigger_type(
irq_get_irq_data(swrm->irq), irq_get_irq_data(swrm->irq),
IRQ_TYPE_NONE); IRQ_TYPE_NONE);
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
free_irq(swrm->irq, swrm);
} }
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
err_irq_fail: err_irq_fail:
mutex_destroy(&swrm->irq_lock); mutex_destroy(&swrm->irq_lock);
mutex_destroy(&swrm->mlock); mutex_destroy(&swrm->mlock);
@@ -2757,15 +2757,15 @@ static int swrm_remove(struct platform_device *pdev)
swrm->reg_irq(swrm->handle, swr_mstr_interrupt, swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
swrm, SWR_IRQ_FREE); swrm, SWR_IRQ_FREE);
} else if (swrm->irq) { } else if (swrm->irq) {
free_irq(swrm->irq, swrm);
irqd_set_trigger_type( irqd_set_trigger_type(
irq_get_irq_data(swrm->irq), irq_get_irq_data(swrm->irq),
IRQ_TYPE_NONE); IRQ_TYPE_NONE);
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
free_irq(swrm->irq, swrm);
} else if (swrm->wake_irq > 0) { } else if (swrm->wake_irq > 0) {
free_irq(swrm->wake_irq, swrm); free_irq(swrm->wake_irq, swrm);
} }
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
cancel_work_sync(&swrm->wakeup_work); cancel_work_sync(&swrm->wakeup_work);
pm_runtime_disable(&pdev->dev); pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev); pm_runtime_set_suspended(&pdev->dev);