Vinayak Menon
6a14021cd6
ion: invalidate the pool pointers after free
...
ion_system_heap_destroy_pools frees the pool, but
does not invalidate the pointer. This can result in
a double free if ion_system_heap_create_pools fails,
and then causes ion_system_heap_create to call into
ion_system_heap_destroy_pools again from the error
path. This can happen in ion_system_heap_create when
one of the secure pool creation fails.
Change-Id: Ic73ca78722aa5a575cc4dd7c1caa560b518094f2
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org >
[haggertk: Backport to 3.4/msm8974]
CVE-2018-11987
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org >
2019-08-09 11:42:04 +02:00
..
2019-08-05 14:20:47 +02:00
2019-08-02 15:14:10 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-02 15:14:10 +02:00
2019-08-08 12:19:52 +02:00
2019-08-06 12:33:17 +02:00
2019-08-05 14:20:47 +02:00
2015-09-10 10:50:52 +05:30
2019-08-08 16:35:20 +02:00
2019-08-05 14:21:57 +02:00
2019-08-06 12:26:35 +02:00
2019-08-08 16:37:16 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:21:53 +02:00
2019-08-05 14:20:47 +02:00
2019-08-08 15:00:19 +02:00
2019-08-05 14:20:47 +02:00
2019-08-02 15:14:10 +02:00
2019-08-06 12:31:22 +02:00
2019-08-05 14:20:47 +02:00
2019-08-02 15:14:10 +02:00
2019-08-06 11:41:21 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 09:13:25 +02:00
2019-08-09 10:00:22 +02:00
2019-08-05 09:13:27 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-09 11:42:04 +02:00
2019-08-08 16:37:26 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-06 08:17:38 +02:00
2019-08-05 14:20:47 +02:00
2019-08-06 10:44:59 +02:00
2019-08-08 16:35:52 +02:00
2019-08-05 14:20:47 +02:00
2019-08-02 15:14:10 +02:00
2019-08-05 14:20:47 +02:00
2019-08-06 11:41:21 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-08 16:35:41 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-09 09:59:25 +02:00
2019-08-06 11:41:21 +02:00
2019-08-05 09:08:00 +02:00
2019-08-06 10:44:59 +02:00
2019-08-08 16:37:22 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-06 10:44:59 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-08 16:37:22 +02:00
2019-08-05 14:20:47 +02:00
2019-08-08 10:39:37 +02:00
2019-08-05 14:20:47 +02:00
2019-08-02 15:14:10 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-06 12:31:33 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-08 15:08:50 +02:00
2019-08-08 15:25:13 +02:00
2019-08-08 10:42:14 +02:00
2019-08-06 11:48:23 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 11:18:51 +02:00
2019-08-05 14:20:47 +02:00
2019-08-08 15:09:54 +02:00
2019-08-06 12:26:35 +02:00
2019-08-06 12:31:35 +02:00
2019-08-06 12:24:29 +02:00
2019-08-08 16:37:22 +02:00
2019-08-05 14:20:47 +02:00
2019-08-05 14:20:47 +02:00
2019-08-09 10:42:02 +02:00
2019-08-05 14:20:47 +02:00
2019-08-06 11:41:21 +02:00
2019-08-05 14:20:47 +02:00
2019-08-06 10:44:59 +02:00
2019-08-08 12:10:20 +02:00
2019-08-08 12:10:20 +02:00