From: Abel Vesa <abel.vesa@linaro.org>
To: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>,
Amol Maheshwari <amahesh@qti.qualcomm.com>,
Ekansh Gupta <ekangupt@qti.qualcomm.com>,
Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
Cc: Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-arm-msm@vger.kernel.org,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Ola Jeppsson <ola@snap.com>
Subject: [PATCH 2/3] misc: fastrpc: Don't remove map on creater_process and device_release
Date: Fri, 2 Sep 2022 18:14:22 +0300 [thread overview]
Message-ID: <20220902151423.3351414-2-abel.vesa@linaro.org> (raw)
In-Reply-To: <20220902151423.3351414-1-abel.vesa@linaro.org>
Do not remove the map from the list on error path in
fastrpc_init_create_process, instead call fastrpc_map_put, to avoid
use-after-free. Do not remove it on fastrpc_device_release either,
call fastrpc_map_put instead.
The fastrpc_free_map is the only proper place to remove the map.
This is called only after the reference count is 0.
Fixes: b49f6d83e290f ("misc: fastrpc: Fix a possible double free")
Co-developed-by: Ola Jeppsson <ola@snap.com>
Signed-off-by: Ola Jeppsson <ola@snap.com>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
---
drivers/misc/fastrpc.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 0c816a11eeec..50c17f5da3a8 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -316,6 +316,13 @@ static void fastrpc_free_map(struct kref *ref)
dma_buf_put(map->buf);
}
+ if (map->fl) {
+ spin_lock(&map->fl->lock);
+ list_del(&map->node);
+ spin_unlock(&map->fl->lock);
+ map->fl = NULL;
+ }
+
kfree(map);
}
@@ -1266,12 +1273,7 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
fl->init_mem = NULL;
fastrpc_buf_free(imem);
err_alloc:
- if (map) {
- spin_lock(&fl->lock);
- list_del(&map->node);
- spin_unlock(&fl->lock);
- fastrpc_map_put(map);
- }
+ fastrpc_map_put(map);
err:
kfree(args);
@@ -1347,10 +1349,8 @@ static int fastrpc_device_release(struct inode *inode, struct file *file)
fastrpc_context_put(ctx);
}
- list_for_each_entry_safe(map, m, &fl->maps, node) {
- list_del(&map->node);
+ list_for_each_entry_safe(map, m, &fl->maps, node)
fastrpc_map_put(map);
- }
list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
list_del(&buf->node);
--
2.34.1
next prev parent reply other threads:[~2022-09-02 15:32 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-02 15:14 [PATCH 1/3] misc: fastrpc: Fix use-after-free and race in fastrpc_map_find Abel Vesa
2022-09-02 15:14 ` Abel Vesa [this message]
2022-09-22 22:46 ` [PATCH 2/3] misc: fastrpc: Don't remove map on creater_process and device_release Srinivas Kandagatla
2022-09-02 15:14 ` [PATCH 3/3] misc: fastrpc: Fix use-after-free race condition for maps Abel Vesa
2022-09-22 22:45 ` Srinivas Kandagatla
2022-09-22 22:46 ` [PATCH 1/3] misc: fastrpc: Fix use-after-free and race in fastrpc_map_find Srinivas Kandagatla
2022-11-24 17:49 [PATCH 0/3] misc: fastrpc: fixes for 6.1 Srinivas Kandagatla
2022-11-24 17:49 ` [PATCH 2/3] misc: fastrpc: Don't remove map on creater_process and device_release Srinivas Kandagatla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220902151423.3351414-2-abel.vesa@linaro.org \
--to=abel.vesa@linaro.org \
--cc=amahesh@qti.qualcomm.com \
--cc=arnd@arndb.de \
--cc=ekangupt@qti.qualcomm.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ola@snap.com \
--cc=quic_vgattupa@quicinc.com \
--cc=srinivas.kandagatla@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.