From 2c6e06a790a6c10240c14b7c2b4bf5aabbb4d3df Mon Sep 17 00:00:00 2001 From: Vamsi krishna Gattupalli Date: Mon, 14 Dec 2020 11:06:27 +0530 Subject: [PATCH] msm:ADSPRPC :Fix to avoid Use after free in fastrpc_internal_munmap Added a check to validate map before freeing it to avoid Use after free scenario. Change-Id: I484391ff7c55c0689530a928a2821ee5a1a0e10c Signed-off-by: Vamsi krishna Gattupalli Issue: SEC-2916 (cherry picked from commit 14d4bb80a2adba18b0c4d125dd330fec9f9d4162) --- drivers/char/adsprpc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index faa00c363b3..56b496d1598 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -1172,6 +1172,11 @@ static int fastrpc_internal_munmap(struct fastrpc_apps *me, VERIFY(err, 0 == (err = fastrpc_munmap_on_dsp(me, munmap, fdata->cid))); if (err) goto bail; + VERIFY(err, map != NULL); + if (err) { + err = -EINVAL; + goto bail; + } spin_lock(&fdata->hlock); hlist_for_each_entry_safe(map, pos, n, &fdata->hlst, hn) { if (map->vaddrout == munmap->vaddrout &&