TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: adsprpc: Avoid double free on map

Browse Source 
Decrement and check the ref count of map
inside the lock. Otherwise, two threads may
free the same map.

Change-Id: I081b937bfd3e8da3e2480f062cad6966662994b5
Acked-by: Sharad Kumar <sharku@qti.qualcomm.com>
Signed-off-by: Abhinav Parihar <quic_parihar@quicinc.com>
This commit is contained in:
Abhinav Parihar
2024-12-30 14:48:16 +05:30
parent c29b693900
commit 1f0408fc9d
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/char/adsprpc.c
View File

@@ -900,9 +900,11 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags)
map->refs--; map->refs--;
if (!map->refs) if (!map->refs)
hlist_del_init(&map->hn); hlist_del_init(&map->hn);
spin_unlock(&me->hlock); if (map->refs > 0) {
if (map->refs > 0) spin_unlock(&me->hlock);
return; return;
}
spin_unlock(&me->hlock);
} else { } else {
if (map->refs) if (map->refs)
map->refs--; map->refs--;