From 69b244c12089af7ecff71f99d64d52ae65345462 Mon Sep 17 00:00:00 2001 From: Arun Kumar Neelakantam Date: Thu, 22 Mar 2018 17:41:28 +0530 Subject: [PATCH] soc: qcom: ipc_router_smd_xprt: Set pointer to NULL after free in_pkt pointer is holding dangling pointer address even after calling release_pkt() which causing use-after-free. Set the in_pkt pointer to NULL after free. CRs-Fixed: 2210859 Change-Id: If5e01c0109c947e52f3ff269c9b2b50ac0dc2bdf Signed-off-by: Arun Kumar Neelakantam --- drivers/soc/qcom/ipc_router_smd_xprt.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/ipc_router_smd_xprt.c b/drivers/soc/qcom/ipc_router_smd_xprt.c index 513689a58456..c7224515fc4d 100644 --- a/drivers/soc/qcom/ipc_router_smd_xprt.c +++ b/drivers/soc/qcom/ipc_router_smd_xprt.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2016, 2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -296,8 +296,10 @@ static void smd_xprt_read_data(struct work_struct *work) spin_lock_irqsave(&smd_xprtp->ss_reset_lock, flags); if (smd_xprtp->ss_reset) { spin_unlock_irqrestore(&smd_xprtp->ss_reset_lock, flags); - if (smd_xprtp->in_pkt) + if (smd_xprtp->in_pkt) { release_pkt(smd_xprtp->in_pkt); + smd_xprtp->in_pkt = NULL; + } smd_xprtp->is_partial_in_pkt = 0; IPC_RTR_ERR("%s: %s channel reset\n", __func__, smd_xprtp->xprt.name); @@ -350,6 +352,7 @@ static void smd_xprt_read_data(struct work_struct *work) __func__, smd_xprtp->xprt.name); kfree_skb(ipc_rtr_pkt); release_pkt(smd_xprtp->in_pkt); + smd_xprtp->in_pkt = NULL; smd_xprtp->is_partial_in_pkt = 0; return; }