Unverified Commit 7499f8a0 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11281 misc: fastrpc: Fix use-after-free race condition for maps 

Merge Pull Request from: @ci-robot 
 
PR sync from: Lin Ruifeng <linruifeng4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5NGBW3FAVTUAIQT4M62BNOZYAABR65EG/ 
 
https://gitee.com/src-openeuler/kernel/issues/IALICT 
 
Link:https://gitee.com/openeuler/kernel/pulls/11281

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 2d5e6fcd 50548d37

drivers/misc/fastrpc.c

+5 −3
Original line number Diff line number Diff line
@@ -263,10 +263,12 @@ static void fastrpc_map_put(struct fastrpc_map *map) 
		kref_put(&map->refcount, fastrpc_free_map);

}



static void fastrpc_map_get(struct fastrpc_map *map)

static int fastrpc_map_get(struct fastrpc_map *map)

{

	if (map)

		kref_get(&map->refcount);

	if (!map)

		return -ENOENT;



	return kref_get_unless_zero(&map->refcount) ? 0 : -ENOENT;

}



static int fastrpc_map_find(struct fastrpc_user *fl, int fd,