rpmsg: glink: Fix use after free in open_ack TIMEOUT case
authorArun Kumar Neelakantam <aneela@codeaurora.org>
Fri, 4 Oct 2019 22:26:58 +0000 (15:26 -0700)
committerBjorn Andersson <bjorn.andersson@linaro.org>
Wed, 16 Oct 2019 16:38:20 +0000 (09:38 -0700)
commitac74ea01860170699fb3b6ea80c0476774c8e94f
tree80fc0853e1079b71771a77b3f558314fb61d0c56
parentb85f6b601407347f5425c4c058d1b7871f5bf4f0
rpmsg: glink: Fix use after free in open_ack TIMEOUT case

Extra channel reference put when remote sending OPEN_ACK after timeout
causes use-after-free while handling next remote CLOSE command.

Remove extra reference put in timeout case to avoid use-after-free.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
drivers/rpmsg/qcom_glink_native.c