[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20230323013655.366-1-k1rh4.lee@gmail.com>
Date: Thu, 23 Mar 2023 10:36:55 +0900
From: Sangsup Lee <k1rh4.lee@...il.com>
To: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
Cc: Amol Maheshwari <amahesh@....qualcomm.com>,
Arnd Bergmann <arnd@...db.de>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org,
Sangsup lee <k1rh4.lee@...il.com>
Subject: [PATCH v2] misc: fastrpc: Fix a Use after-free-bug by race condition
From: Sangsup lee <k1rh4.lee@...il.com>
This patch adds mutex_lock for fixing an Use-after-free bug.
fastrpc_req_munmap_impl can be called concurrently in multi-threded environments.
The buf which is allocated by list_for_each_safe can be used after another thread frees it.
Signed-off-by: Sangsup lee <k1rh4.lee@...il.com>
---
V1 -> V2: moving the locking to ioctl.
drivers/misc/fastrpc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 93ebd174d848..aa1cf0e9f4ed 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1901,7 +1901,9 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
err = fastrpc_req_mmap(fl, argp);
break;
case FASTRPC_IOCTL_MUNMAP:
+ mutex_lock(&fl->mutex);
err = fastrpc_req_munmap(fl, argp);
+ mutex_unlock(&fl->mutex);
break;
case FASTRPC_IOCTL_MEM_MAP:
err = fastrpc_req_mem_map(fl, argp);
--
2.25.1
Powered by blists - more mailing lists