path: root/drivers/rpmsg/qcom_glink_native.c
diff options
authorArun Kumar Neelakantam <aneela@codeaurora.org>2019-10-04 15:26:58 -0700
committerBjorn Andersson <bjorn.andersson@linaro.org>2019-10-16 09:38:20 -0700
commitac74ea01860170699fb3b6ea80c0476774c8e94f (patch)
tree80fc0853e1079b71771a77b3f558314fb61d0c56 /drivers/rpmsg/qcom_glink_native.c
parentb85f6b601407347f5425c4c058d1b7871f5bf4f0 (diff)
rpmsg: glink: Fix use after free in open_ack TIMEOUT case
Extra channel reference put when remote sending OPEN_ACK after timeout causes use-after-free while handling next remote CLOSE command. Remove extra reference put in timeout case to avoid use-after-free. Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") Cc: stable@vger.kernel.org Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Diffstat (limited to 'drivers/rpmsg/qcom_glink_native.c')
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 9355ce26fd98..72ed671f5dcd 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1103,13 +1103,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink,
* Send a close request to "undo" our open-ack. The close-ack will
- * release the last reference.
+ * release qcom_glink_send_open_req() reference and the last reference
+ * will be relesed after receiving remote_close or transport unregister
+ * by calling qcom_glink_native_remove().
qcom_glink_send_close_req(glink, channel);
- /* Release qcom_glink_send_open_req() reference */
- kref_put(&channel->refcount, qcom_glink_channel_release);
return ret;