Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 529c059a authored by Ram Nagesh's avatar Ram Nagesh Committed by Gerrit - the friendly Code Review server
Browse files

msm: synx: Check for zero before reducing bind handles



Suppose user has sent invalid external fence to bind API. Now, while
binding, if synx signal comes in parallel, it will set number of bound
synxs as 0 after signal. Further reduction on that number(num_bound_synxs)
(in case of callback registration failure) would make it wrap
around. So, now num_bound_synxs is large value and abrupt close on synx
fd will lead to synx_util_object_destroy. Here, the for loop on
num_bound_synxs would lead to invalid memory access.

This change decrements num_bound_synxs only if not zero.

Change-Id: I0cfffc90d4164b149c87545818ae4dcf57fc4c46
Signed-off-by: default avatarRam Nagesh <quic_ramnages@quicinc.com>
parent 184d0909
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment