diff options
| author | Krishna Reddy <vdumpa@nvidia.com> | 2016-11-04 12:45:53 -0700 |
|---|---|---|
| committer | Winnie Hsu <whsu@nvidia.com> | 2017-07-26 11:25:50 -0700 |
| commit | 481eb890d4c989e61a998dca11797a3035f1b1de (patch) | |
| tree | bd330dda889430ec68721b439150bd7e9f94c61b /net/bluetooth/l2cap_core.c | |
| parent | 54c1cc0aa58a97e18563c6d996d5dde741055ddd (diff) | |
video: tegra: nvmap: fix nvmap create handle vulnerability
Handle the race condition between malicious fd close and
copy_to_user error, which can create use after free condition.
This is fixed by deferring the fd install, which eliminates
the race that leads to use after free condition.
Fixing Google Bug 32160775.
Bug 1835857
Change-Id: I337807e4360661beced8f9e1155c47b66607b8df
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: http://git-master/r/1248391
Reviewed-on: https://git-master.nvidia.com/r/1512958
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
Diffstat (limited to 'net/bluetooth/l2cap_core.c')
0 files changed, 0 insertions, 0 deletions