Commit 74003385 authored May 12, 2020 by Srinivas Kandagatla Committed by Greg Kroah-Hartman May 15, 2020

misc: fastrpc: fix potential fastrpc_invoke_ctx leak



fastrpc_invoke_ctx can have refcount of 2 in error path where
rpmsg_send() fails to send invoke message. decrement the refcount
properly in the error path to fix this leak.

This also fixes below static checker warning:

drivers/misc/fastrpc.c:990 fastrpc_internal_invoke()
warn: 'ctx->refcount.refcount.ref.counter' not decremented on lines: 990.

Fixes: c68cfb71 ("misc: fastrpc: Add support for context")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20200512110930.2550-1-srinivas.kandagatla@linaro.org


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 0978de9f

drivers/misc/fastrpc.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -904,6 +904,7 @@ static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,
		struct fastrpc_channel_ctx *cctx;
		struct fastrpc_user *fl = ctx->fl;
		struct fastrpc_msg *msg = &ctx->msg;
		int ret;

		cctx = fl->cctx;
		msg->pid = fl->tgid;
		@@ -919,7 +920,13 @@ static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,
		msg->size = roundup(ctx->msg_sz, PAGE_SIZE);
		fastrpc_context_get(ctx);

		return rpmsg_send(cctx->rpdev->ept, (void )msg, sizeof(msg));
		ret = rpmsg_send(cctx->rpdev->ept, (void )msg, sizeof(msg));

		if (ret)
		fastrpc_context_put(ctx);

		return ret;

		}

		static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,

Admin message