Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8dbc282f authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "rpmsg: glink: Fix use after free of channel refcount"

parents 1c7c9eee dbbf47b8

drivers/rpmsg/qcom_glink_native.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -1851,8 +1851,10 @@ void qcom_glink_native_remove(struct qcom_glink *glink) 




	spin_lock_irqsave(&glink->idr_lock, flags);

	spin_lock_irqsave(&glink->idr_lock, flags);

	/* Release any defunct local channels, waiting for close-ack */

	/* Release any defunct local channels, waiting for close-ack */

	idr_for_each_entry(&glink->lcids, channel, cid)

	idr_for_each_entry(&glink->lcids, channel, cid) {

		kref_put(&channel->refcount, qcom_glink_channel_release);

		if (kref_put(&channel->refcount, qcom_glink_channel_release))

			idr_remove(&glink->lcids, cid);

	}





	/* Release any defunct local channels, waiting for close-req */

	/* Release any defunct local channels, waiting for close-req */

	idr_for_each_entry(&glink->lcids, channel, cid)

	idr_for_each_entry(&glink->lcids, channel, cid)