A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcedev: fix UAF in qcedev_smmu

Browse source 
External researcher found UAF in qcedev_smmu.c on an error condition in
qcedev_check_and_map_buffer. When an error occurs, we free binfo, but it
is still kept in the registeredbufs list. The fix removes it from the
list before freeing binfo.

Change-Id: I0327e456bd46106b12c36a5a21305407aae428dd
Signed-off-by: Daniel Perez-Zoghbi <quic_dperezzo@quicinc.com>
This commit is contained in:
Daniel Perez-Zoghbi 2024-07-22 16:13:32 -07:00
commit ed97e9cf1d
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/crypto/msm/qcedev_smmu.c
View file

@ -350,8 +350,12 @@ int qcedev_check_and_map_buffer(void *handle,
return 0;
unmap:
if (!found)
if (!found) {
qcedev_unmap_buffer(handle, mem_client, binfo);
mutex_lock(&qce_hndl->registeredbufs.lock);
list_del(&binfo->list);
mutex_unlock(&qce_hndl->registeredbufs.lock);
}
error:
kfree(binfo);