From 0739405b7bdf80e2df88bd7602cff31f55d5bcde Mon Sep 17 00:00:00 2001 From: Edgar Flores Date: Wed, 5 Aug 2020 10:56:20 -0700 Subject: [PATCH] msm: adsprpc: prevent use-after-free from fastrpc ctx Avoid using fastrpc ctx after sending rpmsg since it may get free during async session. During async fastrpc session there is race condition where after sending rpmsg the ctx could be free from async query thread. Change-Id: I5738163096e429f19bd9b495699a1897083737b3 Signed-off-by: Edgar Flores --- drivers/char/adsprpc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 1dbabaebd18b..193759144c5e 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -2589,7 +2589,8 @@ static int fastrpc_invoke_send(struct smq_invoke_ctx *ctx, } err = rpmsg_send(channel_ctx->rpdev->ept, (void *)msg, sizeof(*msg)); trace_fastrpc_rpmsg_send(fl->cid, (uint64_t)ctx, msg->invoke.header.ctx, - handle, ctx->sc, msg->invoke.page.addr, msg->invoke.page.size); + handle, msg->invoke.header.sc, msg->invoke.page.addr, + msg->invoke.page.size); mutex_unlock(&channel_ctx->rpmsg_mutex); bail: return err;