commit e90984691704701909a7044a3f30591eb73bc60f
author Mohit Aggarwal <maggarwa@codeaurora.org> Thu Jul 06 10:16:52 2017 +0530
committer abel_fang <Abel_Fang@compal.com> Thu Mar 01 16:21:01 2018 +0800
tree 9147110f472bddd550def4f4b3d930ba40047965
parent 77add496dfe6c02d53cd55cc692894d5b484900a

diag: Add protection while de-initializing clients

Currently, while de-initializing clients, there is
a possibility of using already freed memory. The
patch adds proper protection to fix the issue.

CRs-Fixed: 2068569
Change-Id: I4b397a82e03fa2f1c84cfa8ca912cdb6a51ba08b
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>

drivers/char/diag/diagchar_core.c

diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c
index 53d92a4..896e53e 100644
--- a/drivers/char/diag/diagchar_core.c
+++ b/drivers/char/diag/diagchar_core.c
@@ -1649,14 +1649,18 @@
 {
 	int i;
 
+	mutex_lock(&driver->diagchar_mutex);
 	for (i = 0; i < driver->num_clients; i++)
 		if (driver->client_map[i].pid == current->tgid)
 			break;
 
-	if (i == driver->num_clients)
+	if (i == driver->num_clients) {
+		mutex_unlock(&driver->diagchar_mutex);
 		return -EINVAL;
+	}
 
 	driver->data_ready[i] |= DEINIT_TYPE;
+	mutex_unlock(&driver->diagchar_mutex);
 	wake_up_interruptible(&driver->wait_q);
 
 	return 1;