rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

msm:ADSPRPC :Fix to avoid Use after free in fastrpc_internal_munmap

Browse Source 
Added a check to validate map before freeing it to avoid Use after
free scenario.

Change-Id: I484391ff7c55c0689530a928a2821ee5a1a0e10c
Signed-off-by: Vamsi krishna Gattupalli <vgattupa@codeaurora.org>
Issue: SEC-2916
(cherry picked from commit 14d4bb80a2adba18b0c4d125dd330fec9f9d4162)
This commit is contained in:
Vamsi krishna Gattupalli
2021-10-10 23:46:48 +02:00
committed by Francescodario Cuzzocrea
parent d5edb9b824
commit 2c6e06a790
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/char/adsprpc.c
+5
View File
@@ -1172,6 +1172,11 @@ static int fastrpc_internal_munmap(struct fastrpc_apps *me,
VERIFY(err, 0 == (err = fastrpc_munmap_on_dsp(me, munmap, fdata->cid)));
if (err)
goto bail;
VERIFY(err, map != NULL);
if (err) {
err = -EINVAL;
goto bail;
}
spin_lock(&fdata->hlock);
hlist_for_each_entry_safe(map, pos, n, &fdata->hlst, hn) {
if (map->vaddrout == munmap->vaddrout &&