| commit | 20c8a0089294504692c17419fe67381689325d6d | [log] [tgz] |
|---|---|---|
| author | Chenbo Feng <fengc@google.com> | Tue Nov 28 18:22:11 2017 -0800 |
| committer | Todd Kjos <tkjos@google.com> | Wed Feb 07 15:57:14 2018 -0800 |
| tree | 0d4ea6436b00d27d3eb603837bd52bcb218faaa3 | |
| parent | 550c01d0e051461437d6e9d72f573759e7bc5047 [diff] |
ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree When multiple threads is trying to tag/delete the same socket at the same time, there is a chance the tag_ref_entry of the target socket to be null before the uid_tag_data entry is freed. It is caused by the ctrl_cmd_tag function where it doesn't correctly grab the spinlocks when tagging a socket. Signed-off-by: Chenbo Feng <fengc@google.com> Bug: 65853158 Change-Id: I5d89885918054cf835370a52bff2d693362ac5f0