From e5a17398e40d988ce7e9c79259eb8b08b5377b43 Mon Sep 17 00:00:00 2001 From: Mukesh Pilaniya Date: Wed, 6 Aug 2025 16:15:32 +0530 Subject: [PATCH] ANDROID: gunyah: Fix use-after-free in gunyah_vm_clean_resources() The gunyah_vm_clean_resources() function was freeing resources without removing them from the ghvm->resources list, leaving dangling pointers that could lead to use-after-free. Fix this by removing each resource from the list before freeing it to ensure lists are empty after cleanup. Bug: 436769530 Change-Id: I16bb2a73dae66cdef9e62f65b93d1487e32a92ce Signed-off-by: Mukesh Pilaniya --- drivers/virt/gunyah/vm_mgr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/virt/gunyah/vm_mgr.c b/drivers/virt/gunyah/vm_mgr.c index 2843385560ba..7b0bacb512d7 100644 --- a/drivers/virt/gunyah/vm_mgr.c +++ b/drivers/virt/gunyah/vm_mgr.c @@ -458,6 +458,7 @@ static void gunyah_vm_clean_resources(struct gunyah_vm *ghvm) } list_for_each_entry_safe(ghrsc, riter, &ghvm->resources, list) { + list_del(&ghrsc->list); gunyah_rm_free_resource(ghrsc); } mutex_unlock(&ghvm->resources_lock);