Skip to content
Commit d4b9e0d3 authored by Tapas Dey's avatar Tapas Dey Committed by Gerrit - the friendly Code Review server
Browse files

msm: adsprpc: Handle UAF in fastrpc_buf_free 


Thread T1 add buffer to fl->cached_bufs and release fl->hlock and holding
buffer reference. Now thread T2 will aquire fl->hlock and free buffer in
fastrpc_cached_buf_list_free(). T1 will dereference the freed buffer.
Moving reference buffer uses for T1 inside fl->hlock to avoid UAF.

Change-Id: I5f08d5497099133f87d55f5879cfe50c2ba23ae6
Signed-off-by: default avatarTapas Dey <quic_tapadey@quicinc.com>
parent 71918c99
Hide whitespace changes
Inline Side-by-side
Please register or to comment