lkml.org 
[lkml]   [2023]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v2] misc: fastrpc: Fix a Use after-free-bug by race condition
Date
From: Sangsup lee <k1rh4.lee@gmail.com>

This patch adds mutex_lock for fixing an Use-after-free bug.
fastrpc_req_munmap_impl can be called concurrently in multi-threded environments.
The buf which is allocated by list_for_each_safe can be used after another thread frees it.

Signed-off-by: Sangsup lee <k1rh4.lee@gmail.com>
---
V1 -> V2: moving the locking to ioctl.

drivers/misc/fastrpc.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 93ebd174d848..aa1cf0e9f4ed 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1901,7 +1901,9 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
err = fastrpc_req_mmap(fl, argp);
break;
case FASTRPC_IOCTL_MUNMAP:
+ mutex_lock(&fl->mutex);
err = fastrpc_req_munmap(fl, argp);
+ mutex_unlock(&fl->mutex);
break;
case FASTRPC_IOCTL_MEM_MAP:
err = fastrpc_req_mem_map(fl, argp);
--
2.25.1
\
 
 \ /
  Last update: 2023-03-27 01:13    [W:0.158 / U:0.488 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site