mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-06 03:45:24 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
556dfdb226
commit 96b328d119eca7563c1edcc4e1039a62e6370ecb upstream.
It is possible that in between calling fastrpc_map_get() until
map->fl->lock is taken in fastrpc_free_map(), another thread can call
fastrpc_map_lookup() and get a reference to a map that is about to be
deleted.
Rewrite fastrpc_map_get() to only increase the reference count of a map
if it's non-zero. Propagate this to callers so they can know if a map is
about to be deleted.
Fixes this warning:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate
...
Call trace:
refcount_warn_saturate
[fastrpc_map_get inlined]
[fastrpc_map_lookup inlined]
fastrpc_map_create
fastrpc_internal_invoke
fastrpc_device_ioctl
__arm64_sys_ioctl
invoke_syscall
Fixes:
|
||
| .. | ||
| altera-stapl | ||
| c2port | ||
| cardreader | ||
| cb710 | ||
| cxl | ||
| echo | ||
| eeprom | ||
| genwqe | ||
| habanalabs | ||
| ibmasm | ||
| lis3lv02d | ||
| lkdtm | ||
| mei | ||
| mic | ||
| ocxl | ||
| sgi-gru | ||
| sgi-xp | ||
| ti-st | ||
| vmw_vmci | ||
| ad525x_dpot-i2c.c | ||
| ad525x_dpot-spi.c | ||
| ad525x_dpot.c | ||
| ad525x_dpot.h | ||
| apds990x.c | ||
| apds9802als.c | ||
| atmel-ssc.c | ||
| atmel_tclib.c | ||
| bh1770glc.c | ||
| cs5535-mfgpt.c | ||
| ds1682.c | ||
| dummy-irq.c | ||
| enclosure.c | ||
| fastrpc.c | ||
| hmc6352.c | ||
| hpilo.c | ||
| hpilo.h | ||
| ibmvmc.c | ||
| ibmvmc.h | ||
| ics932s401.c | ||
| isl29003.c | ||
| isl29020.c | ||
| Kconfig | ||
| kgdbts.c | ||
| lattice-ecp3-config.c | ||
| Makefile | ||
| pch_phub.c | ||
| pci_endpoint_test.c | ||
| phantom.c | ||
| pti.c | ||
| pvpanic.c | ||
| qcom-coincell.c | ||
| sram-exec.c | ||
| sram.c | ||
| sram.h | ||
| tifm_7xx1.c | ||
| tifm_core.c | ||
| tsl2550.c | ||
| vexpress-syscfg.c | ||
| vmw_balloon.c | ||
| xilinx_sdfec.c | ||