From: Chris Lew <clew@codeaurora.org>
To: Bjorn Andersson <bjorn.andersson@linaro.org>,
Ohad Ben-Cohen <ohad@wizery.com>
Cc: linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH v2 2/6] rpmsg: glink: Fix use after free in open_ack TIMEOUT case
Date: Tue, 8 Oct 2019 17:51:05 -0700 [thread overview]
Message-ID: <3db040ee-6b0f-be45-0e23-ab65f16329b6@codeaurora.org> (raw)
In-Reply-To: <20191004222702.8632-3-bjorn.andersson@linaro.org>
On 10/4/2019 3:26 PM, Bjorn Andersson wrote:
> From: Arun Kumar Neelakantam <aneela@codeaurora.org>
>
> Extra channel reference put when remote sending OPEN_ACK after timeout
> causes use-after-free while handling next remote CLOSE command.
>
> Remove extra reference put in timeout case to avoid use-after-free.
>
> Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
> Cc: stable@vger.kernel.org
> Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
> ---
Acked-By: Chris Lew <clew@codeaurora.org>
--
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
next prev parent reply other threads:[~2019-10-09 0:51 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-04 22:26 [PATCH v2 0/6] rpmsg: glink stability fixes Bjorn Andersson
2019-10-04 22:26 ` [PATCH v2 1/6] rpmsg: glink: Fix reuse intents memory leak issue Bjorn Andersson
2019-10-09 0:49 ` Chris Lew
2019-10-04 22:26 ` [PATCH v2 2/6] rpmsg: glink: Fix use after free in open_ack TIMEOUT case Bjorn Andersson
2019-10-09 0:51 ` Chris Lew [this message]
2019-10-04 22:26 ` [PATCH v2 3/6] rpmsg: glink: Put an extra reference during cleanup Bjorn Andersson
2019-10-04 22:27 ` [PATCH v2 4/6] rpmsg: glink: Fix rpmsg_register_device err handling Bjorn Andersson
2019-10-04 22:27 ` [PATCH v2 5/6] rpmsg: glink: Don't send pending rx_done during remove Bjorn Andersson
2019-10-09 1:08 ` Chris Lew
2019-10-04 22:27 ` [PATCH v2 6/6] rpmsg: glink: Free pending deferred work on remove Bjorn Andersson
2019-10-09 1:17 ` Chris Lew
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3db040ee-6b0f-be45-0e23-ab65f16329b6@codeaurora.org \
--to=clew@codeaurora.org \
--cc=bjorn.andersson@linaro.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-remoteproc@vger.kernel.org \
--cc=ohad@wizery.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox