ANDROID: gunyah: Fix use-after-free in gunyah_vm_clean_resources()
The gunyah_vm_clean_resources() function was freeing resources without removing them from the ghvm->resources list, leaving dangling pointers that could lead to use-after-free. Fix this by removing each resource from the list before freeing it to ensure lists are empty after cleanup. Bug: 436769530 Change-Id: I16bb2a73dae66cdef9e62f65b93d1487e32a92ce Signed-off-by: Mukesh Pilaniya <quic_mpilaniy@quicinc.com>
This commit is contained in:
committed by
Treehugger Robot
parent
886d2f37b7
commit
e5a17398e4
@@ -458,6 +458,7 @@ static void gunyah_vm_clean_resources(struct gunyah_vm *ghvm)
|
||||
}
|
||||
|
||||
list_for_each_entry_safe(ghrsc, riter, &ghvm->resources, list) {
|
||||
list_del(&ghrsc->list);
|
||||
gunyah_rm_free_resource(ghrsc);
|
||||
}
|
||||
mutex_unlock(&ghvm->resources_lock);
|
||||
|
||||
Reference in New Issue
Block a user