Unverified Commit a5aaf6b4 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11850 misc: fastrpc: Fix double free of 'buf' in error path 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiaomeng Zhang <zhangxiaomeng13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/CIHFMY2EOEK4QUPQW6HQ65LC37XJKOVY/ 
 
https://gitee.com/src-openeuler/kernel/issues/IATRLJ 
 
Link:https://gitee.com/openeuler/kernel/pulls/11850

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents ec389320 bb175ce7

drivers/misc/fastrpc.c

+2 −3
Original line number Diff line number Diff line
@@ -1912,7 +1912,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) 
				      &args[0]);

	if (err) {

		dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);

		goto err_invoke;

		fastrpc_buf_free(buf);

		return err;

	}



	/* update the buffer to be able to deallocate the memory on the DSP */
@@ -1950,8 +1951,6 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) 


err_assign:

	fastrpc_req_munmap_impl(fl, buf);

err_invoke:

	fastrpc_buf_free(buf);



	return err;

}