github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: ipa: fix SMEM state handle leaks in SMP2P init

Browse Source 
ipa_smp2p_init() acquires two Qualcomm SMEM state handles with
qcom_smem_state_get(). However, neither the init error paths
nor ipa_smp2p_exit() release them.

Release both handles with qcom_smem_state_put() in the init
error paths and in ipa_smp2p_exit().

Fixes: 530f9216a9 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
Reviewed-by: Alex Elder <elder@riscstar.com>
Link: https://patch.msgid.link/20260624065955.2822765-1-haoxiang_li2024@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Haoxiang Li 2026-06-24 14:59:55 +08:00 committed by Jakub Kicinski
parent 805185b7c7
commit 96ca1e658a
1 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
drivers/net/ipa/ipa_smp2p.c
View File

@ -232,19 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
&valid_bit);
if (IS_ERR(valid_state))
return PTR_ERR(valid_state);
if (valid_bit >= 32) /* BITS_PER_U32 */
return -EINVAL;
if (valid_bit >= 32) { /* BITS_PER_U32 */
ret = -EINVAL;
goto err_valid_state_put;
}
enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
&enabled_bit);
if (IS_ERR(enabled_state))
return PTR_ERR(enabled_state);
if (enabled_bit >= 32) /* BITS_PER_U32 */
return -EINVAL;
if (IS_ERR(enabled_state)) {
ret = PTR_ERR(enabled_state);
goto err_valid_state_put;
}
if (enabled_bit >= 32) { /* BITS_PER_U32 */
ret = -EINVAL;
goto err_enabled_state_put;
}
smp2p = kzalloc_obj(*smp2p);
if (!smp2p)
return -ENOMEM;
if (!smp2p) {
ret = -ENOMEM;
goto err_enabled_state_put;
}
smp2p->ipa = ipa;
@ -289,6 +297,10 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
ipa->smp2p = NULL;
mutex_destroy(&smp2p->mutex);
kfree(smp2p);
err_enabled_state_put:
qcom_smem_state_put(enabled_state);
err_valid_state_put:
qcom_smem_state_put(valid_state);
return ret;
}
@ -305,6 +317,8 @@ void ipa_smp2p_exit(struct ipa *ipa)
ipa_smp2p_power_release(ipa);
ipa->smp2p = NULL;
mutex_destroy(&smp2p->mutex);
qcom_smem_state_put(smp2p->enabled_state);
qcom_smem_state_put(smp2p->valid_state);
kfree(smp2p);
}