Re: [PATCH] mailbox: fix a UAF bug in msg_submit()

[Xianting TIan]

在 2021/8/17 下午12:29, Jassi Brar 写道:
> On Fri, Aug 6, 2021 at 7:15 AM Xianting Tian
> <xianting.tian@xxxxxxxxxxxxxxxxx> wrote:
> > We met a UAF issue during our mailbox testing.
> >
> > In synchronous mailbox, we use mbox_send_message() to send a message
> > and wait for completion. mbox_send_message() calls msg_submit() to
> > send the message for the first time, if timeout, it will send the
> > message in tx_tick() for the second time.
> Seems like your controller's  .send_data() returns error. Can you
> please explain why it does so? Because
> send_data() only _accepts_ data for further transmission... which
> should seldom be a problem.


> thanks.