| From 0094c1b44d6a103099a1dd1d0fa8a30959a400ab Mon Sep 17 00:00:00 2001 |
| From: Arun Kumar Neelakantam <aneela@codeaurora.org> |
| Date: Fri, 4 Oct 2019 15:26:58 -0700 |
| Subject: [PATCH] rpmsg: glink: Fix use after free in open_ack TIMEOUT case |
| |
| commit ac74ea01860170699fb3b6ea80c0476774c8e94f upstream. |
| |
| Extra channel reference put when remote sending OPEN_ACK after timeout |
| causes use-after-free while handling next remote CLOSE command. |
| |
| Remove extra reference put in timeout case to avoid use-after-free. |
| |
| Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") |
| Cc: stable@vger.kernel.org |
| Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> |
| Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> |
| Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c |
| index 7ea782b74de0..7aeca5fe29be 100644 |
| --- a/drivers/rpmsg/qcom_glink_native.c |
| +++ b/drivers/rpmsg/qcom_glink_native.c |
| @@ -1103,13 +1103,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink, |
| close_link: |
| /* |
| * Send a close request to "undo" our open-ack. The close-ack will |
| - * release the last reference. |
| + * release qcom_glink_send_open_req() reference and the last reference |
| + * will be relesed after receiving remote_close or transport unregister |
| + * by calling qcom_glink_native_remove(). |
| */ |
| qcom_glink_send_close_req(glink, channel); |
| |
| - /* Release qcom_glink_send_open_req() reference */ |
| - kref_put(&channel->refcount, qcom_glink_channel_release); |
| - |
| return ret; |
| } |
| |
| -- |
| 2.7.4 |
| |
