android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: qrtr: hold ept sem lock before node lookup

Browse Source 
Node ref count decrement and test is performed inside ept
sem lock while node lookup is done inside node spin lock.
This can sometime cause node lookup to succeed while parallely
node can be freed in node release function. This will further
use of node and will result in use after free.

Additionally hold ept smem lock before performing node lookup.

Change-Id: Iaa5781c56ebee51611dfea9fddcde50f1367dfea
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
Signed-off-by: Jay Jayanna <jayanna@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
This commit is contained in:
Chris Lew 2022-10-27 11:07:12 -07:00
parent 2b0465b6c3
commit 67789fda41
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/qrtr/af_qrtr.c
View File

@ -479,10 +479,12 @@ static struct qrtr_node *qrtr_node_lookup(unsigned int nid)
struct qrtr_node *node;
unsigned long flags;
down_read(&qrtr_epts_lock);
spin_lock_irqsave(&qrtr_nodes_lock, flags);
node = radix_tree_lookup(&qrtr_nodes, nid);
node = qrtr_node_acquire(node);
spin_unlock_irqrestore(&qrtr_nodes_lock, flags);
up_read(&qrtr_epts_lock);
return node;
}