tree 17369b4a03a09a3fe9c2166ede349bd745164e62
parent a4b334e1f65f6ff432ef6215c8b93f83dad17097
author Chenbo Feng <fengc@google.com> 1511922131 -0800
committer Todd Kjos <tkjos@google.com> 1518047317 -0800

ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree

When multiple threads is trying to tag/delete the same socket at the
same time, there is a chance the tag_ref_entry of the target socket to
be null before the uid_tag_data entry is freed. It is caused by the
ctrl_cmd_tag function where it doesn't correctly grab the spinlocks
when tagging a socket.

Signed-off-by: Chenbo Feng <fengc@google.com>
Bug: 65853158
Change-Id: I5d89885918054cf835370a52bff2d693362ac5f0