msm: synx: Check for zero before reducing bind handles
Suppose user has sent invalid external fence to bind API. Now, while
binding, if synx signal comes in parallel, it will set number of bound
synxs as 0 after signal. Further reduction on that number(num_bound_synxs)
(in case of callback registration failure) would make it wrap
around. So, now num_bound_synxs is large value and abrupt close on synx
fd will lead to synx_util_object_destroy. Here, the for loop on
num_bound_synxs would lead to invalid memory access.
This change decrements num_bound_synxs only if not zero.
Change-Id: I0cfffc90d4164b149c87545818ae4dcf57fc4c46
Signed-off-by:
Ram Nagesh <quic_ramnages@quicinc.com>
Loading
Please register or sign in to comment