msm: adsprpc: Handle UAF in fastrpc_mmap_remove_ssr

Currently unlocking the spinlock during maps list iteration
can lead to use after free. Fix is to lock, read one map
from list, stop iteration and unlock, repeate same for all
the maps complete in the list.

Acked-by: Ramesh Nallagopu <rnallago@qti.qualcomm.com>
Change-Id: I834bdcb9dd55a33f6308188ec1f844b7d81cb30e
Signed-off-by: Ansa Ahmed <quic_ansa@quicinc.com>
此提交包含在:
Ansa Ahmed
2024-02-28 13:53:51 +05:30
父節點 941b3f835f
當前提交 4e20907ac2
共有 2 個檔案被更改,包括 112 行新增101 行删除

查看文件

@@ -785,6 +785,7 @@ struct fastrpc_mmap {
struct timespec64 map_end_time;
/* Mapping for fastrpc shell */
bool is_filemap;
bool is_dumped; /* flag to indicate map is dumped during SSR */
char *servloc_name; /* Indicate which daemon mapped this */
/* Indicates map is being used by a pending RPC call */
unsigned int ctx_refs;