samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Forkuj 0
Kod Zgłoszenia Oczekujące zmiany Actions Packages Projekty Wydania Wiki Aktywność

disp: msm: dp: clear MST sim context during DP sim disable

Przeglądaj źródła 
After freeing MST sim context memory the pointer isn't set
to NULL leading to unauthorized memory access. Along with
this fix, this change also defers checking sim device ports
pointer at a more appropriate place in the function call.

Change-Id: I20c09edbd454c9d491060815dc73bae34aab6b08
Signed-off-by: Sandeep Gangadharaiah <quic_sandgang@quicinc.com>
This commit is contained in:
Sandeep Gangadharaiah
2022-09-09 13:54:06 -07:00
zatwierdzone przez Gerrit - the friendly Code Review server
rodzic 5d2c1a0801
commit 31ae12f079
3 zmienionych plików z 35 dodań i 33 usunięć
Ściągnij plik aktualizacji Ściągnij plik porównania Expand all files Collapse all files

43
msm/dp/dp_mst_sim_helper.c
Wyświetl plik

@@ -1055,6 +1055,18 @@ static void dp_mst_sim_notify(struct dp_mst_sim_context *ctx,
queue_work(ctx->wq, &work->base);
}
static void dp_mst_sim_free_ports(struct dp_mst_sim_context *ctx)
{
u32 i;
for (i = 0; i < ctx->port_num; i++)
kfree(ctx->ports[i].edid);
kfree(ctx->ports);
ctx->ports = NULL;
ctx->port_num = 0;
}
int dp_mst_sim_update(void *mst_sim_context, u32 port_num,
struct dp_mst_sim_port *ports)
{
@@ -1064,7 +1076,7 @@ int dp_mst_sim_update(void *mst_sim_context, u32 port_num,
u32 update_mask = 0;
u32 i;
if (!ctx || port_num >= 15)
if (!ctx || port_num >= 15 || !ports)
return -EINVAL;
mutex_lock(&ctx->session_lock);
@@ -1081,19 +1093,17 @@ int dp_mst_sim_update(void *mst_sim_context, u32 port_num,
}
}
for (i = 0; i < ctx->port_num; i++)
kfree(ctx->ports[i].edid);
kfree(ctx->ports);
ctx->port_num = 0;
dp_mst_sim_free_ports(ctx);
if (port_num) {
ctx->ports = kcalloc(port_num, sizeof(*ports), GFP_KERNEL);
if (!ctx->ports) {
rc = -ENOMEM;
goto fail;
}
ctx->port_num = port_num;
if (!port_num)
goto end;
ctx->ports = kcalloc(port_num, sizeof(*ports), GFP_KERNEL);
if (!ctx->ports) {
rc = -ENOMEM;
goto fail;
}
ctx->port_num = port_num;
for (i = 0; i < port_num; i++) {
ctx->ports[i] = ports[i];
@@ -1116,13 +1126,10 @@ int dp_mst_sim_update(void *mst_sim_context, u32 port_num,
}
fail:
if (rc) {
for (i = 0; i < ctx->port_num; i++)
kfree(ctx->ports[i].edid);
kfree(ctx->ports);
ctx->port_num = 0;
}
if (rc)
dp_mst_sim_free_ports(ctx);
end:
mutex_unlock(&ctx->session_lock);
if (update_mask)