diff options
Diffstat (limited to 'meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-arm64-ack-5.10/tc/0007-mailbox-arm_mhuv2-Skip-calling-kfree-with-invalid-po.patch')
-rw-r--r-- | meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-arm64-ack-5.10/tc/0007-mailbox-arm_mhuv2-Skip-calling-kfree-with-invalid-po.patch | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-arm64-ack-5.10/tc/0007-mailbox-arm_mhuv2-Skip-calling-kfree-with-invalid-po.patch b/meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-arm64-ack-5.10/tc/0007-mailbox-arm_mhuv2-Skip-calling-kfree-with-invalid-po.patch new file mode 100644 index 0000000000..cf5b0b06df --- /dev/null +++ b/meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-arm64-ack-5.10/tc/0007-mailbox-arm_mhuv2-Skip-calling-kfree-with-invalid-po.patch @@ -0,0 +1,41 @@ +From 81d76e92b03a6f33acefd8aef168948c5f595205 Mon Sep 17 00:00:00 2001 +From: Viresh Kumar <viresh.kumar@linaro.org> +Date: Mon, 22 Feb 2021 12:48:06 +0530 +Subject: [PATCH 07/22] mailbox: arm_mhuv2: Skip calling kfree() with invalid + pointer + +It is possible that 'data' passed to kfree() is set to a error value +instead of allocated space. Make sure it doesn't get called with invalid +pointer. + +Fixes: 5a6338cce9f4 ("mailbox: arm_mhuv2: Add driver") +Cc: v5.11 <stable@vger.kernel.org> # v5.11 +Reported-by: kernel test robot <lkp@intel.com> +Reported-by: Dan Carpenter <dan.carpenter@oracle.com> +Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> +Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> + +Upstream-Status: Backport [https://lkml.org/lkml/2021/2/22/57] +Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com> +--- + drivers/mailbox/arm_mhuv2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mailbox/arm_mhuv2.c b/drivers/mailbox/arm_mhuv2.c +index cdfb1939fabf..d997f8ebfa98 100644 +--- a/drivers/mailbox/arm_mhuv2.c ++++ b/drivers/mailbox/arm_mhuv2.c +@@ -699,7 +699,9 @@ static irqreturn_t mhuv2_receiver_interrupt(int irq, void *arg) + ret = IRQ_HANDLED; + } + +- kfree(data); ++ if (!IS_ERR(data)) ++ kfree(data); ++ + return ret; + } + +-- +2.17.1 + |