Commit 01059ed0 authored Jul 06, 2017 by Mohit Aggarwal Committed by Bernhard Thoben Feb 27, 2021

diag: Add protection while de-initializing clients



Currently, while de-initializing clients, there is
a possibility of using already freed memory. The
patch adds proper protection to fix the issue.

CRs-Fixed: 2068569
Bug: 68870904
Change-Id: I4b397a82e03fa2f1c84cfa8ca912cdb6a51ba08b
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
(cherry picked from commit 51639fdeb18a0ab7a98c4466f6db84d5062b1060)

parent be64e222

drivers/char/diag/diagchar_core.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -1051,14 +1051,18 @@ static int diag_ioctl_lsm_deinit(void)
		{
		int i;

		mutex_lock(&driver->diagchar_mutex);
		for (i = 0; i < driver->num_clients; i++)
		if (driver->client_map[i].pid == current->tgid)
		break;

		if (i == driver->num_clients)
		if (i == driver->num_clients) {
		mutex_unlock(&driver->diagchar_mutex);
		return -EINVAL;
		}

		driver->data_ready[i] \|= DEINIT_TYPE;
		mutex_unlock(&driver->diagchar_mutex);
		wake_up_interruptible(&driver->wait_q);

		return 1;