From 74f8e34b7b44c575379ee78ced4ecdf1cb852679 Mon Sep 17 00:00:00 2001 From: Arun Kumar Neelakantam Date: Mon, 16 Jul 2018 12:00:48 +0530 Subject: [PATCH] rpmsg: glink: Fix use after free of channel refcount Channel reference count is used after free in case of channel is not fully opened due to errors and SSR happens. Remove the channel ID from glink LCID list for last reference to avoid re-using the stale pointer from LCID list. Change-Id: Ibe2627444d42ef12860bdec36f147b01128cdf11 Signed-off-by: Arun Kumar Neelakantam --- drivers/rpmsg/qcom_glink_native.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c index 297959329633..ebe24cf9ad47 100644 --- a/drivers/rpmsg/qcom_glink_native.c +++ b/drivers/rpmsg/qcom_glink_native.c @@ -1832,8 +1832,16 @@ void qcom_glink_native_remove(struct qcom_glink *glink) dev_warn(glink->dev, "Can't remove GLINK devices: %d\n", ret); /* Release any defunct local channels, waiting for close-ack */ - idr_for_each_entry(&glink->lcids, channel, cid) + idr_for_each_entry(&glink->lcids, channel, cid) { kref_put(&channel->refcount, qcom_glink_channel_release); + idr_remove(&glink->lcids, cid); + } + + /* Release any defunct local channels, waiting for close-req */ + idr_for_each_entry(&glink->rcids, channel, cid) { + kref_put(&channel->refcount, qcom_glink_channel_release); + idr_remove(&glink->rcids, cid); + } /* Release any defunct local channels, waiting for close-req */ idr_for_each_entry(&glink->rcids, channel, cid)