CVE-2022-48872

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix use-after-free race condition for maps

It is possible that in between calling fastrpcmapget() until map->fl->lock is taken in fastrpcfreemap(), another thread can call fastrpcmaplookup() and get a reference to a map that is about to be deleted.

Rewrite fastrpcmapget() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted.

Fixes this warning: refcountt: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcountwarnsaturate ... Call trace: refcountwarnsaturate [fastrpcmapget inlined] [fastrpcmaplookup inlined] fastrpcmapcreate fastrpcinternalinvoke fastrpcdevice_ioctl _arm64sysioctl invokesyscall