Google Git
Sign in
android / kernel / google-modules / lwis / refs/heads/android-gs-akita-5.15-android15
commit705b335f9c36b598f5fbb08aa5a730b04c994fa4[log] [tgz]
authorHolmes Chou <[email protected]>Wed Jun 26 18:59:57 2024 +0800
committerHolmes Chou <[email protected]>Thu Jun 27 10:55:19 2024 +0800
tree3c4e84db8dee971283cdab5b00025fca6e18d55b
parentdeda4741852bbae188dfb3c4718b804311e845d7 [diff]
Allocator: Fix UAF in lwis_allocator_release()

Current implementations use a spinlock to protect block_mgr accessing,
but this spinlock is holded by block_mgr. It causes use-after-free when
release block_mgr. Move the spinlock to lwis_dev to fix it.

Bug: 349428550
Test: GCA, CTS, PTS
Change-Id: Ia436514cb3485cfab1da64e21b2618808f28db1c
Signed-off-by: Holmes Chou <[email protected]>
4 files changed
tree: 3c4e84db8dee971283cdab5b00025fca6e18d55b
  1. platform/
  2. .clang-format
  3. BUILD.bazel
  4. Kbuild
  5. Kconfig
  6. lwis_allocator.c
  7. lwis_allocator.h
  8. lwis_buffer.c
  9. lwis_buffer.h
  10. lwis_clock.c
  11. lwis_clock.h
  12. lwis_commands.h
  13. lwis_debug.c
  14. lwis_debug.h
  15. lwis_device.c
  16. lwis_device.h
  17. lwis_device_dpm.c
  18. lwis_device_dpm.h
  19. lwis_device_i2c.c
  20. lwis_device_i2c.h
  21. lwis_device_ioreg.c
  22. lwis_device_ioreg.h
  23. lwis_device_slc.c
  24. lwis_device_slc.h
  25. lwis_device_spi.c
  26. lwis_device_spi.h
  27. lwis_device_test.c
  28. lwis_device_test.h
  29. lwis_device_top.c
  30. lwis_device_top.h
  31. lwis_dt.c
  32. lwis_dt.h
  33. lwis_event.c
  34. lwis_event.h
  35. lwis_fence.c
  36. lwis_fence.h
  37. lwis_gpio.c
  38. lwis_gpio.h
  39. lwis_i2c.c
  40. lwis_i2c.h
  41. lwis_i2c_bus_manager.c
  42. lwis_i2c_bus_manager.h
  43. lwis_i2c_sched.c
  44. lwis_i2c_sched.h
  45. lwis_interrupt.c
  46. lwis_interrupt.h
  47. lwis_io_entry.c
  48. lwis_io_entry.h
  49. lwis_ioctl.c
  50. lwis_ioctl.h
  51. lwis_ioreg.c
  52. lwis_ioreg.h
  53. lwis_periodic_io.c
  54. lwis_periodic_io.h
  55. lwis_phy.c
  56. lwis_phy.h
  57. lwis_pinctrl.c
  58. lwis_pinctrl.h
  59. lwis_platform.h
  60. lwis_platform_dma.h
  61. lwis_regulator.c
  62. lwis_regulator.h
  63. lwis_spi.c
  64. lwis_spi.h
  65. lwis_trace.h
  66. lwis_transaction.c
  67. lwis_transaction.h
  68. lwis_util.c
  69. lwis_util.h
  70. lwis_version.c
  71. lwis_version.h
  72. Makefile