Commit ac74ea01 authored Oct 04, 2019 by Arun Kumar Neelakantam Committed by Bjorn Andersson Oct 16, 2019

rpmsg: glink: Fix use after free in open_ack TIMEOUT case



Extra channel reference put when remote sending OPEN_ACK after timeout
causes use-after-free while handling next remote CLOSE command.

Remove extra reference put in timeout case to avoid use-after-free.

Fixes: b4f8e52b ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>

parent b85f6b60

drivers/rpmsg/qcom_glink_native.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -1103,13 +1103,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink,
		close_link:
		/*
		* Send a close request to "undo" our open-ack. The close-ack will
		* release the last reference.
		* release qcom_glink_send_open_req() reference and the last reference
		* will be relesed after receiving remote_close or transport unregister
		* by calling qcom_glink_native_remove().
		*/
		qcom_glink_send_close_req(glink, channel);

		/* Release qcom_glink_send_open_req() reference */
		kref_put(&channel->refcount, qcom_glink_channel_release);

		return ret;
		}

Admin message