soc: qcom: service-notifier: Fix use after free of clnt_handle
commit <3494711b>("soc: qcom: service-notifier: fix object corruption") aims to prevent use after free scenarios by adding a mutex. Take this idea further and wrap all usages of clnt_handle with a rwmutex to synchronize against destroying the clnt_handle and prevent potential use after free cases. Additionally, move the rwmutex to a per-instance variable as opposed to a global structure. ================================================================= BUG kmalloc-512 (Tainted: G W O ): Poison overwritten ----------------------------------------------------------------- INFO: Allocated in qmi_handle_create+0x50/0x308 age=408897 cpu=7 pid=31796 __slab_alloc.isra.68.constprop.71+0x58/0x98 kmem_cache_alloc_trace+0x198/0x2c4 qmi_handle_create+0x50/0x308 root_service_service_arrive+0x58/0x270 process_one_work+0x184/0x480 worker_thread+0x140/0x4b4 kthread+0xf4/0x108 ret_from_fork+0x10/0x30 INFO: Freed in qmi_handle_destroy+0x144/0x178 age=10 cpu=1 pid=19288 kfree+0x28c/0x290 qmi_handle_destroy+0x144/0x178 free_qmi_handle+0x38/0x50 process_one_work+0x184/0x480 worker_thread+0x140/0x4b4 kthread+0xf4/0x108 ret_from_fork+0x10/0x30 Change-Id: I6c13d373e14adb8f5d1bc1e73e3203f4ae0a7089 Signed-off-by: Kyle Yan <kyan@codeaurora.org>
Loading
Please register or sign in to comment