[go: nahoru, domu]

Skip to content
Commit b1f71f18 authored by Santosh Sakore's avatar Santosh Sakore
Browse files

msm: adsprpc : Fix use after free in fastrpc_internal_mem_unmap



Thread 1 can make a to call fastrpc_mmap_create under internal mem map
and release fl->map_mutex. Thread 2 can make call to internal mem unmap,
acquire fl->map_mutex and get same map though fastrpc_mmap_remove.
Thread 1 fail in fastrpc_mem_map_to_dsp jumps to bail and do map free.
Thread 2 still holds same map which can lead use after free. Serialize
fastrpc internal mem map and unmap.

Change-Id: I54a3602914b43fc67635c0de193bd21aa13daaa3
Signed-off-by: default avatarSantosh Sakore <quic_ssakore@quicinc.com>
parent 860a4121
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment