A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: eva: User after free fix in msm_cvp_mark_user_persist

Browse source 
Update buffer ktid inside mutex protetion.

Change-Id: I86767eb60e1f78e373233c0f64c3b5a2249cba0e
Signed-off-by: Gopireddy Arunteja Reddy <quic_garuntej@quicinc.com>
This commit is contained in:
Gopireddy Arunteja Reddy 2024-03-06 23:41:05 +05:30 • committed by Marco Zhang
commit 1babb91a34
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
drivers/media/platform/msm/cvp/msm_cvp_buf.c
View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include "msm_cvp_common.h"
@ -643,9 +644,10 @@ int msm_cvp_mark_user_persist(struct msm_cvp_inst *inst,
list_for_each_entry_safe(pbuf, dummy, &inst->persistbufs.list,
list) {
if (pbuf->ownership == CLIENT) {
if (pbuf->fd == buf->fd &&
pbuf->size == buf->size)
if (pbuf->fd == buf->fd && pbuf->size == buf->size) {
buf->fd = pbuf->smem->device_addr;
pbuf->ktid = ktid;
}
rc = 1;
break;
}
@ -657,7 +659,6 @@ int msm_cvp_mark_user_persist(struct msm_cvp_inst *inst,
rc = -EFAULT;
break;
}
pbuf->ktid = ktid;
rc = 0;
}
return rc;