Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit beb519f7 authored by Raghavendra Rao Ananta's avatar Raghavendra Rao Ananta Committed by Elliot Berman
Browse files

haven: dbl: Fix use-after-free in tx/rx unregister 



The hh_dbl_tx_unregister() and hh_dbl_rx_unregister() functions
tries to dereference client_desc in pr_debug(), which would
have already been freed if the tx/rx's counterpart was unregistered.
Hence, move the pr_debug() statements right before the section
where kfree() is called on client_desc to avoid use-after-free.

Change-Id: I183b0a3df0665ab90a85e0907b39641cd19f4923
Signed-off-by: default avatarRaghavendra Rao Ananta <rananta@codeaurora.org>
parent e5734f37

drivers/virt/haven/hh_dbl.c

+6 −6
Original line number Original line Diff line number Diff line
@@ -443,6 +443,9 @@ int hh_dbl_tx_unregister(void *dbl_client_desc) 
		return -EINVAL;

		return -EINVAL;

	}

	}





	pr_debug("%s: Unregistering client for label: %d\n",

			__func__, client_desc->label);



	/* Rx client still holding the "client_desc". Do not remove now. */

	/* Rx client still holding the "client_desc". Do not remove now. */

	if (!cap_table_entry->rx_reg_done) {

	if (!cap_table_entry->rx_reg_done) {

		cap_table_entry->client_desc = NULL;

		cap_table_entry->client_desc = NULL;
@@ -454,9 +457,6 @@ int hh_dbl_tx_unregister(void *dbl_client_desc) 
	cap_table_entry->tx_reg_done = 0;

	cap_table_entry->tx_reg_done = 0;

	mutex_unlock(&cap_table_entry->cap_entry_lock);

	mutex_unlock(&cap_table_entry->cap_entry_lock);





	pr_debug("%s: Unregistered client for label: %d\n",

			__func__, client_desc->label);



	return 0;

	return 0;

}

}

EXPORT_SYMBOL(hh_dbl_tx_unregister);

EXPORT_SYMBOL(hh_dbl_tx_unregister);
@@ -494,6 +494,9 @@ int hh_dbl_rx_unregister(void *dbl_client_desc) 
		return -EINVAL;

		return -EINVAL;

	}

	}





	pr_debug("%s: Unregistering client for label: %d\n", __func__,

			 client_desc->label);



	/* Tx client still holding the "client_desc". Do not remove now.*/

	/* Tx client still holding the "client_desc". Do not remove now.*/

	if (!cap_table_entry->tx_reg_done) {

	if (!cap_table_entry->tx_reg_done) {

		cap_table_entry->client_desc = NULL;

		cap_table_entry->client_desc = NULL;
@@ -508,9 +511,6 @@ int hh_dbl_rx_unregister(void *dbl_client_desc) 




	mutex_unlock(&cap_table_entry->cap_entry_lock);

	mutex_unlock(&cap_table_entry->cap_entry_lock);





	pr_debug("%s: Unregistered client for label: %d\n", __func__,

		 client_desc->label);



	return 0;

	return 0;

}

}

EXPORT_SYMBOL(hh_dbl_rx_unregister);

EXPORT_SYMBOL(hh_dbl_rx_unregister);