msm: ipc: Check pointer validity before dereferencing it
Transport OPEN and CLOSE events are handled by dynamically allocating a
work. Check that the work item is properly allocated before dereferencing
it.
Change-Id: Icb73548f0747494791f14f9c8014f8effd4b844c
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
diff --git a/arch/arm/mach-msm/ipc_router.c b/arch/arm/mach-msm/ipc_router.c
index 6587bf5..a93c114 100644
--- a/arch/arm/mach-msm/ipc_router.c
+++ b/arch/arm/mach-msm/ipc_router.c
@@ -2957,18 +2957,28 @@
D("open event for '%s'\n", xprt->name);
xprt_work = kmalloc(sizeof(struct msm_ipc_router_xprt_work),
GFP_ATOMIC);
- xprt_work->xprt = xprt;
- INIT_WORK(&xprt_work->work, xprt_open_worker);
- queue_work(msm_ipc_router_workqueue, &xprt_work->work);
+ if (xprt_work) {
+ xprt_work->xprt = xprt;
+ INIT_WORK(&xprt_work->work, xprt_open_worker);
+ queue_work(msm_ipc_router_workqueue, &xprt_work->work);
+ } else {
+ pr_err("%s: malloc failure - Couldn't notify OPEN event",
+ __func__);
+ }
break;
case IPC_ROUTER_XPRT_EVENT_CLOSE:
D("close event for '%s'\n", xprt->name);
xprt_work = kmalloc(sizeof(struct msm_ipc_router_xprt_work),
GFP_ATOMIC);
- xprt_work->xprt = xprt;
- INIT_WORK(&xprt_work->work, xprt_close_worker);
- queue_work(msm_ipc_router_workqueue, &xprt_work->work);
+ if (xprt_work) {
+ xprt_work->xprt = xprt;
+ INIT_WORK(&xprt_work->work, xprt_close_worker);
+ queue_work(msm_ipc_router_workqueue, &xprt_work->work);
+ } else {
+ pr_err("%s: malloc failure - Couldn't notify CLOSE event",
+ __func__);
+ }
break;
}