Changeset fb1f664 in mainline

Timestamp:

2018-03-11T07:35:05Z (7 years ago)

Author:

Jakub Jermar <jakub@…>

Children:

8a5de14

Parents:

58290b05

git-author:

Jakub Jermar <jakub@…> (2018-03-04 17:39:45)

git-committer:

Jakub Jermar <jakub@…> (2018-03-11 07:35:05)

Message:

Fix race condition

The capability created by phone_alloc() may get destroyed before
kobject_get(), so we must test kobject_get() return value.

File:

• kernel/generic/src/ipc/ops/conctmeto.c (modified) (1 diff)

kernel/generic/src/ipc/ops/conctmeto.c

@@ -52 +52 @@
         }
 
-        /* Set arg5 for server */
+        /* Set ARG5 for server */
         kobject_t *phone_obj = kobject_get(TASK, phone_handle,
             KOBJECT_TYPE_PHONE);
+        if (!phone_obj) {
+                /*
+                 * Another thread of the same task can destroy the new
+                 * capability before we manage to get a reference from it.
+                 */
+                call->priv = -1;
+                return ENOENT;
+        }
         /* Hand over phone_obj's reference to ARG5 */
         IPC_SET_ARG5(call->data, (sysarg_t) phone_obj->phone);