CVE-2022-48821

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> misc: fastrpc: avoid double fput() on failed usercopy<br /> <br /> If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF<br /> ioctl(), we shouldn&amp;#39;t assume that &amp;#39;buf-&gt;dmabuf&amp;#39; is still valid. In fact,<br /> dma_buf_fd() called fd_install() before, i.e. "consumed" one reference,<br /> leaving us with none.<br /> <br /> Calling dma_buf_put() will therefore put a reference we no longer own,<br /> leading to a valid file descritor table entry for an already released<br /> &amp;#39;file&amp;#39; object which is a straight use-after-free.<br /> <br /> Simply avoid calling dma_buf_put() and rely on the process exit code to<br /> do the necessary cleanup, if needed, i.e. if the file descriptor is<br /> still valid.