| From 31e92bc31be8b6af17279942dcd739d678d60ef7 Mon Sep 17 00:00:00 2001 |
| From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> |
| Date: Tue, 12 May 2020 12:09:30 +0100 |
| Subject: [PATCH] misc: fastrpc: fix potential fastrpc_invoke_ctx leak |
| |
| commit 74003385cf716f1b88cc7753ca282f5493f204a2 upstream. |
| |
| fastrpc_invoke_ctx can have refcount of 2 in error path where |
| rpmsg_send() fails to send invoke message. decrement the refcount |
| properly in the error path to fix this leak. |
| |
| This also fixes below static checker warning: |
| |
| drivers/misc/fastrpc.c:990 fastrpc_internal_invoke() |
| warn: 'ctx->refcount.refcount.ref.counter' not decremented on lines: 990. |
| |
| Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context") |
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> |
| Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> |
| Link: https://lore.kernel.org/r/20200512110930.2550-1-srinivas.kandagatla@linaro.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c |
| index 90c7e59e461d..8e10b4aa60d0 100644 |
| --- a/drivers/misc/fastrpc.c |
| +++ b/drivers/misc/fastrpc.c |
| @@ -857,6 +857,7 @@ static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx, |
| struct fastrpc_channel_ctx *cctx; |
| struct fastrpc_user *fl = ctx->fl; |
| struct fastrpc_msg *msg = &ctx->msg; |
| + int ret; |
| |
| cctx = fl->cctx; |
| msg->pid = fl->tgid; |
| @@ -872,7 +873,13 @@ static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx, |
| msg->size = roundup(ctx->msg_sz, PAGE_SIZE); |
| fastrpc_context_get(ctx); |
| |
| - return rpmsg_send(cctx->rpdev->ept, (void *)msg, sizeof(*msg)); |
| + ret = rpmsg_send(cctx->rpdev->ept, (void *)msg, sizeof(*msg)); |
| + |
| + if (ret) |
| + fastrpc_context_put(ctx); |
| + |
| + return ret; |
| + |
| } |
| |
| static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel, |
| -- |
| 2.27.0 |
| |