A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 22:23:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

virt: haven: rm_core: Clean up sequence idr earlier

Browse source 
When RM sends an error for a given call, Linux can re-use that sequence
number later. Presently, the sequence number is kept as reserved and
could cause a denial of service if many messages are crafted which
always return an RM error.

Change-Id: Icc2b054ab8d110c63759e30d62650ebc9d02b234
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
This commit is contained in:
Srinivasarao Pathipati 2022-10-10 16:33:22 +05:30
commit bcea72ceab
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/virt/haven/hh_rm_core.c
View file

@ -639,6 +639,10 @@ void *hh_rm_call(hh_rm_msgid_t message_id,
goto out;
}
mutex_lock(&hh_rm_call_idr_lock);
idr_remove(&hh_rm_call_idr, connection->seq);
mutex_unlock(&hh_rm_call_idr_lock);
*rm_error = connection->rm_error;
if (connection->rm_error) {
pr_err("%s: Reply for seq:%d failed with RM err: %d\n",
@ -662,10 +666,6 @@ void *hh_rm_call(hh_rm_msgid_t message_id,
*resp_buff_size = connection->size;
out:
mutex_lock(&hh_rm_call_idr_lock);
idr_remove(&hh_rm_call_idr, connection->seq);
mutex_unlock(&hh_rm_call_idr_lock);
kfree(connection);
return ret;
}