Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd9c167f authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "rpmsg: glink: spi: Fix use after free of channel refcount"

parents 62b108ed 6da83f9d

drivers/rpmsg/qcom_glink_spi.c

+5 −3
Original line number Diff line number Diff line
@@ -561,7 +561,7 @@ static void glink_spi_rx_advance(struct glink_spi *glink, size_t count) 
	tail = pipe->local_addr;

	tail += count;



	if (tail > pipe->fifo_base + pipe->length)

	if (tail >= pipe->fifo_base + pipe->length)

		tail -= pipe->length;



	pipe->local_addr = tail;
@@ -2443,8 +2443,10 @@ static void glink_spi_remove(struct glink_spi *glink) 


	spin_lock_irqsave(&glink->idr_lock, flags);

	/* Release any defunct local channels, waiting for close-ack */

	idr_for_each_entry(&glink->lcids, channel, cid)

		kref_put(&channel->refcount, glink_spi_channel_release);

	idr_for_each_entry(&glink->lcids, channel, cid) {

		if (kref_put(&channel->refcount, glink_spi_channel_release))

			idr_remove(&glink->lcids, cid);

	}



	/* Release any defunct local channels, waiting for close-req */

	idr_for_each_entry(&glink->lcids, channel, cid)