msm: adsprpc: use-after-free (UAF) in global maps
Currently, remote heap maps get added to the global list before the fastrpc_internal_mmap function completes the mapping. Meanwhile, the fastrpc_internal_munmap function accesses the map, starts unmapping, and frees the map before the fastrpc_internal_mmap function completes, resulting in a use-after-free (UAF) issue. Add the map to the list after the fastrpc_internal_mmap function completes the mapping. Change-Id: I72d24c7661244d1ff43454ce31dfc5e932090305 Acked-by:Abhishek Singh <abhishes@qti.qualcomm.com> Signed-off-by:
Santosh Sakore <quic_ssakore@quicinc.com> (cherry picked from commit c7125dff)
Loading
Please register or sign in to comment