Просмотр исходного кода

msm: adsprpc: Fix UAF in fastrpc_print_debug_data

In fastrpc_print_debug_data accessing fl will cause
UAF condition if is_ramdump_enable is not set. In this
case, there won't be any wait condition in fastrpc_file_free
so fl will be freed in between accessing data. To fix this,
check is_ramdump_enable before accessing fl data.

Signed-off-by: quic_anane <[email protected]>
Change-Id: Ia4670a73f887e17afae3cfeb7e6c6457b3337ae9
quic_anane 1 год назад
Родитель
Сommit
b18ae2cb6b
1 измененных файлов с 1 добавлено и 1 удалено
  1. 1 1
      dsp/adsprpc.c

+ 1 - 1
dsp/adsprpc.c

@@ -7646,7 +7646,7 @@ static void  fastrpc_print_debug_data(int cid)
 	}
 	spin_lock_irqsave(&me->hlock, irq_flags);
 	hlist_for_each_entry_safe(fl, n, &me->drivers, hn) {
-		if (fl->cid == cid) {
+		if (fl->cid == cid && fl->is_ramdump_pend) {
 			scnprintf(mini_dump_buff +
 					strlen(mini_dump_buff),
 					MINI_DUMP_DBG_SIZE -