github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-01 12:11:59 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

rpmsg: glink: Fix use after free of channel refcount

Browse Source 
Channel reference count is used after free in case of channel
is not fully opened due to errors and SSR happens.

Remove the channel ID from glink LCID list for last reference to
avoid re-using the stale pointer from LCID list.

Change-Id: Ibe2627444d42ef12860bdec36f147b01128cdf11
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
This commit is contained in:
Arun Kumar Neelakantam 2018-07-16 12:00:48 +05:30 committed by Chris Lew
parent d41dcee41c
commit 74f8e34b7b
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/rpmsg/qcom_glink_native.c
View File

@ -1832,8 +1832,16 @@ void qcom_glink_native_remove(struct qcom_glink *glink)
dev_warn(glink->dev, "Can't remove GLINK devices: %d\n", ret);
/* Release any defunct local channels, waiting for close-ack */
idr_for_each_entry(&glink->lcids, channel, cid)
idr_for_each_entry(&glink->lcids, channel, cid) {
kref_put(&channel->refcount, qcom_glink_channel_release);
idr_remove(&glink->lcids, cid);
}
/* Release any defunct local channels, waiting for close-req */
idr_for_each_entry(&glink->rcids, channel, cid) {
kref_put(&channel->refcount, qcom_glink_channel_release);
idr_remove(&glink->rcids, cid);
}
/* Release any defunct local channels, waiting for close-req */
idr_for_each_entry(&glink->rcids, channel, cid)