ANDROID: gunyah: Fix use-after-free in gunyah_vm_clean_resources()

The gunyah_vm_clean_resources() function was freeing resources without
removing them from the ghvm->resources list, leaving dangling pointers
that could lead to use-after-free.

Fix this by removing each resource from the list before freeing it to
ensure lists are empty after cleanup.

Bug: 436769530
Change-Id: I16bb2a73dae66cdef9e62f65b93d1487e32a92ce
Signed-off-by: Mukesh Pilaniya <quic_mpilaniy@quicinc.com>
This commit is contained in:
Mukesh Pilaniya
2025-08-06 16:15:32 +05:30
committed by Treehugger Robot
parent 886d2f37b7
commit e5a17398e4
+1
View File
@@ -458,6 +458,7 @@ static void gunyah_vm_clean_resources(struct gunyah_vm *ghvm)
}
list_for_each_entry_safe(ghrsc, riter, &ghvm->resources, list) {
list_del(&ghrsc->list);
gunyah_rm_free_resource(ghrsc);
}
mutex_unlock(&ghvm->resources_lock);