From: Sangsup lee <k1rh4.lee@xxxxxxxxx> This patch adds mutex_lock for fixing an Use-after-free bug. fastrpc_req_munmap_impl can be called concurrently in multi-threded environments. The buf which is allocated by list_for_each_safe can be used after another thread frees it. Signed-off-by: Sangsup lee <k1rh4.lee@xxxxxxxxx> --- V1 -> V2: moving the locking to ioctl. drivers/misc/fastrpc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 93ebd174d848..aa1cf0e9f4ed 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1901,7 +1901,9 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd, err = fastrpc_req_mmap(fl, argp); break; case FASTRPC_IOCTL_MUNMAP: + mutex_lock(&fl->mutex); err = fastrpc_req_munmap(fl, argp); + mutex_unlock(&fl->mutex); break; case FASTRPC_IOCTL_MEM_MAP: err = fastrpc_req_mem_map(fl, argp); -- 2.25.1
