ANDROID: gunyah: Fix use-after-free in gunyah_vm_clean_resources() The gunyah_vm_clean_resources() function was freeing resources without removing them from the ghvm->resources list, leaving dangling pointers that could lead to use-after-free. Fix this by removing each resource from the list before freeing it to ensure lists are empty after cleanup. Bug: 436769530 Change-Id: I16bb2a73dae66cdef9e62f65b93d1487e32a92ce Signed-off-by: Mukesh Pilaniya <quic_mpilaniy@quicinc.com>
diff --git a/drivers/virt/gunyah/vm_mgr.c b/drivers/virt/gunyah/vm_mgr.c index e643e33..b7b4a5f 100644 --- a/drivers/virt/gunyah/vm_mgr.c +++ b/drivers/virt/gunyah/vm_mgr.c
@@ -272,6 +272,7 @@ static void gh_vm_clean_resources(struct gh_vm *ghvm) } list_for_each_entry_safe(ghrsc, riter, &ghvm->resources, list) { + list_del(&ghrsc->list); gh_rm_free_resource(ghrsc); } mutex_unlock(&ghvm->resources_lock);