dma-buf: fix race while reading the dma_buf in dmabuffs_dname
The following race occurs while reading the dma_buf: P1 P2 dma_buf_release() dmabuffs_dname()[say from /proc/pid/fd/num] read dmabuf stored in dentry->fsdata Free the dmabuf object Start accessing the dmabuf structure As said above, we access the dmabuf structure after we free the dmabuf object resulting into the below 'use-after-free' issue. __mutex_lock_common+0x174/0x1020 mutex_lock_nested+0x40/0x50 dmabuffs_dname+0x48/0xc8 d_path+0x84/0x290 proc_pid_readlink+0xb4/0x1c8 vfs_readlink+0x128/0x130 do_readlinkat+0xc8/0x148 __arm64_sys_readlinkat+0x24/0x38 el0_svc_common+0xa4/0x178 el0_svc_handler+0x6c/0x88 el0_svc+0x8/0xc. Fixes: bf93f26 ("UPSTREAM: dma-buf: add DMA_BUF_SET_NAME ioctls") Change-Id: Ie0a833f185687f4cc7ab8189b17fde3516270572 Signed-off-by:Charan Teja Reddy <charante@codeaurora.org> Signed-off-by:
Naitik Bharadiya <bharad@codeaurora.org>
Loading
Please register or sign in to comment