diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2014-05-22 08:14:36 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2014-05-22 08:14:35 -0700 |
| commit | c3b9f8e4ce163e4f541c2e0f2a723bed1a4c75e6 (patch) | |
| tree | c90ef15ac845fe8fedd8612e774b92c78f9fb057 /drivers/char | |
| parent | 4eba8568ea5b9e4a1d97c7ebab9668f88eb3b0d9 (diff) | |
| parent | d8c26e52ffbd09dc076fccca8044bb3d7a6d1f68 (diff) | |
Merge "diag: Check for valid proc id while querying real time status"
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/diag/diag_dci.c | 21 | ||||
| -rw-r--r-- | drivers/char/diag/diagchar_core.c | 2 |
2 files changed, 13 insertions, 10 deletions
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index 7912c44f86a6..05a1403bd1dc 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -2712,15 +2712,18 @@ fail_alloc: if (new_entry) { for (i = 0; i < new_entry->num_buffers; i++) { proc_buf = &new_entry->buffers[i]; - mutex_destroy(&proc_buf->health_mutex); - mutex_destroy(&proc_buf->buf_primary->data_mutex); - mutex_destroy(&proc_buf->buf_cmd->data_mutex); - if (proc_buf->buf_primary) - kfree(proc_buf->buf_primary->data); - kfree(proc_buf->buf_primary); - if (proc_buf->buf_cmd) - kfree(proc_buf->buf_cmd->data); - kfree(proc_buf->buf_cmd); + if (proc_buf) { + mutex_destroy(&proc_buf->health_mutex); + mutex_destroy( + &proc_buf->buf_primary->data_mutex); + mutex_destroy(&proc_buf->buf_cmd->data_mutex); + if (proc_buf->buf_primary) + kfree(proc_buf->buf_primary->data); + kfree(proc_buf->buf_primary); + if (proc_buf->buf_cmd) + kfree(proc_buf->buf_cmd->data); + kfree(proc_buf->buf_cmd); + } } kfree(new_entry->dci_event_mask); kfree(new_entry->dci_log_mask); diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c index 58e99199565d..741dd622b30b 100644 --- a/drivers/char/diag/diagchar_core.c +++ b/drivers/char/diag/diagchar_core.c @@ -1116,7 +1116,7 @@ static int diag_ioctl_get_real_time(unsigned long ioarg) usleep_range(10000, 10100); } else { if (rt_query.proc < 0 || - rt_query.proc > DIAG_NUM_PROC) { + rt_query.proc >= DIAG_NUM_PROC) { pr_err("diag: Invalid proc %d in %s\n", rt_query.proc, __func__); return -EINVAL; |