| commit | 22c24eea301b7d28f60cc452a4215f4f0b00af4d | [log] [tgz] |
|---|---|---|
| author | Chenbo Feng <[email protected]> | Tue Nov 28 18:22:11 2017 -0800 |
| committer | Todd Kjos <[email protected]> | Wed Feb 07 15:48:37 2018 -0800 |
| tree | 17369b4a03a09a3fe9c2166ede349bd745164e62 | |
| parent | a4b334e1f65f6ff432ef6215c8b93f83dad17097 [diff] |
ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree When multiple threads is trying to tag/delete the same socket at the same time, there is a chance the tag_ref_entry of the target socket to be null before the uid_tag_data entry is freed. It is caused by the ctrl_cmd_tag function where it doesn't correctly grab the spinlocks when tagging a socket. Signed-off-by: Chenbo Feng <[email protected]> Bug: 65853158 Change-Id: I5d89885918054cf835370a52bff2d693362ac5f0