Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a5b99ad authored by Arun Kumar Neelakantam's avatar Arun Kumar Neelakantam Committed by Greg Kroah-Hartman
Browse files

rpmsg: glink: Fix use after free in open_ack TIMEOUT case 



commit ac74ea01860170699fb3b6ea80c0476774c8e94f upstream.

Extra channel reference put when remote sending OPEN_ACK after timeout
causes use-after-free while handling next remote CLOSE command.

Remove extra reference put in timeout case to avoid use-after-free.

Fixes: b4f8e52b ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: default avatarArun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b909f12e

drivers/rpmsg/qcom_glink_native.c

+3 −4
Original line number Diff line number Diff line
@@ -1106,13 +1106,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink, 
close_link:

	/*

	 * Send a close request to "undo" our open-ack. The close-ack will

	 * release the last reference.

	 * release qcom_glink_send_open_req() reference and the last reference

	 * will be relesed after receiving remote_close or transport unregister

	 * by calling qcom_glink_native_remove().

	 */

	qcom_glink_send_close_req(glink, channel);



	/* Release qcom_glink_send_open_req() reference */

	kref_put(&channel->refcount, qcom_glink_channel_release);



	return ret;

}