msm: adsprpc: Handle UAF in fastrpc_mmap_remove_ssr
Currently unlocking the spinlock during maps list iteration can lead to use after free. Fix is to lock, read one map from list, stop iteration and unlock, repeate same for all the maps complete in the list. Acked-by: Ramesh Nallagopu <rnallago@qti.qualcomm.com> Change-Id: I834bdcb9dd55a33f6308188ec1f844b7d81cb30e Signed-off-by: Ansa Ahmed <quic_ansa@quicinc.com>
此提交包含在:
@@ -785,6 +785,7 @@ struct fastrpc_mmap {
|
||||
struct timespec64 map_end_time;
|
||||
/* Mapping for fastrpc shell */
|
||||
bool is_filemap;
|
||||
bool is_dumped; /* flag to indicate map is dumped during SSR */
|
||||
char *servloc_name; /* Indicate which daemon mapped this */
|
||||
/* Indicates map is being used by a pending RPC call */
|
||||
unsigned int ctx_refs;
|
||||
|
新增問題並參考
封鎖使用者