A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: vidc: Handle race condition for accessing session head

Browse source 
Currently session_end() accesses &dev->sess_head without device->lock.
So there are high chances of use-after-free in &dev->sess_head.

Change-Id: I34593e6507da9bad13c6d92faf40c4d790825d39
Signed-off-by: Priyanka Gujjula <pgujjula@codeaurora.org>
Signed-off-by: Govindaraj Rajagopal <grajagop@codeaurora.org>
This commit is contained in:
Govindaraj Rajagopal 2020-08-04 17:17:48 +05:30
commit 34f376ccdc
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
msm/vidc/hfi_common.c
View file

@ -1984,18 +1984,20 @@ static int venus_hfi_session_end(void *sess)
struct venus_hfi_device *device = &venus_hfi_dev;
int rc = 0;
if (!__is_session_valid(device, session, __func__))
return -EINVAL;
mutex_lock(&device->lock);
if (!__is_session_valid(device, session, __func__)) {
rc = -EINVAL;
goto exit;
}
if (msm_vidc_fw_coverage) {
if (__sys_set_coverage(device, msm_vidc_fw_coverage,
session->sid))
s_vpr_e(session->sid, "Fw_coverage msg ON failed\n");
}
rc = __send_session_cmd(session, HFI_CMD_SYS_SESSION_END);
exit:
mutex_unlock(&device->lock);
return rc;
}