From ca54890d78621c9878328a4215176a4a01f11535 Mon Sep 17 00:00:00 2001 From: Jeya R Date: Mon, 10 Aug 2020 12:49:52 +0530 Subject: [PATCH] adsprpc: Avoid race condition during map find and free Protect remote heap buffer list with spin lock while freeing to avoid UAF in fastrpc_mmap_find() on a buffer that is freed in fastrpc_mmap_free(). Change-Id: Ic3d5219898fcf23fb813eabe5fc2f187b397a472 Acked-by: Chenna Kesava Raju Signed-off-by: Jeya R --- drivers/char/adsprpc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 7458205e9a10..865becf8bc4e 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -993,9 +993,11 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags) } if (map->flags == ADSP_MMAP_HEAP_ADDR || map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) { + spin_lock(&me->hlock); map->refs--; if (!map->refs) hlist_del_init(&map->hn); + spin_unlock(&me->hlock); if (map->refs > 0) { ADSPRPC_WARN( "multiple references for remote heap size %zu va 0x%lx ref count is %d\n",