OSDN Git Service

rpmsg: glink: Fix use after free in open_ack TIMEOUT case
authorArun Kumar Neelakantam <aneela@codeaurora.org>
Fri, 4 Oct 2019 22:26:58 +0000 (15:26 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 21 Dec 2019 09:57:27 +0000 (10:57 +0100)
commit8a5b99adbf6eab308e9986d55505540fe02b1db9
treea77758854e825203ac46b36a58b85f980ecd6061
parentb909f12e3c36e15b6d6b211ebf415c6c55d54557
rpmsg: glink: Fix use after free in open_ack TIMEOUT case

commit ac74ea01860170699fb3b6ea80c0476774c8e94f upstream.

Extra channel reference put when remote sending OPEN_ACK after timeout
causes use-after-free while handling next remote CLOSE command.

Remove extra reference put in timeout case to avoid use-after-free.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/rpmsg/qcom_glink_native.c