diff options
| author | Chenbo Feng <fengc@google.com> | 2017-11-28 18:22:11 -0800 |
|---|---|---|
| committer | Todd Kjos <tkjos@google.com> | 2018-02-07 15:55:38 -0800 |
| commit | 6b8924e4899fbc1093f499338688ad446bd0a4c8 (patch) | |
| tree | daa47c6ca1163f9a1fc3e4ae809ea15e4328e16f /kernel/workqueue.c | |
| parent | 810bdaf1dd747016fea5d5256530cf9ade05a4c9 (diff) | |
ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree
When multiple threads is trying to tag/delete the same socket at the
same time, there is a chance the tag_ref_entry of the target socket to
be null before the uid_tag_data entry is freed. It is caused by the
ctrl_cmd_tag function where it doesn't correctly grab the spinlocks
when tagging a socket.
Signed-off-by: Chenbo Feng <fengc@google.com>
Bug: 65853158
Change-Id: I5d89885918054cf835370a52bff2d693362ac5f0
Diffstat (limited to 'kernel/workqueue.c')
0 files changed, 0 insertions, 0 deletions