msm: ipc: Cache the length of a packet being looped back
When a message is looped back to the user-space, sometimes the
receiver acts quickly, reads the contents of the packet and frees
the buffer. This leads to a scenario where the sender is trying to
dereference the packet length info of a freed packet. Hence a garbage
packet length gets returned to the user-space.
Fix this race condition by storing the packet length of the packet
being looped back into a variable and return the value of that variable
when the loopback operation is complete.
Change-Id: I595a562bfa12151b2f9154df681ce23c965dfff5
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
1 file changed