Skip to content
Commit 879dc5d7 authored by Kyle Yan's avatar Kyle Yan
Browse files

soc: qcom: service-notifier: Fix use after free of clnt_handle



commit <3494711b>("soc: qcom: service-notifier: fix object
corruption") aims to prevent use after free scenarios by adding a mutex.
Take this idea further and wrap all usages of clnt_handle with a rwmutex
to synchronize against destroying the clnt_handle and prevent potential
use after free cases. Additionally, move the rwmutex to a per-instance
variable as opposed to a global structure.

=================================================================
BUG kmalloc-512 (Tainted: G        W  O   ): Poison overwritten
-----------------------------------------------------------------
INFO: Allocated in qmi_handle_create+0x50/0x308 age=408897 cpu=7 pid=31796
 __slab_alloc.isra.68.constprop.71+0x58/0x98
 kmem_cache_alloc_trace+0x198/0x2c4
 qmi_handle_create+0x50/0x308
 root_service_service_arrive+0x58/0x270
 process_one_work+0x184/0x480
 worker_thread+0x140/0x4b4
 kthread+0xf4/0x108
 ret_from_fork+0x10/0x30
INFO: Freed in qmi_handle_destroy+0x144/0x178 age=10 cpu=1 pid=19288
 kfree+0x28c/0x290
 qmi_handle_destroy+0x144/0x178
 free_qmi_handle+0x38/0x50
 process_one_work+0x184/0x480
 worker_thread+0x140/0x4b4
 kthread+0xf4/0x108
 ret_from_fork+0x10/0x30

Change-Id: I6c13d373e14adb8f5d1bc1e73e3203f4ae0a7089
Signed-off-by: default avatarKyle Yan <kyan@codeaurora.org>
parent b3227c4f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment