A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

asoc: Use dma_buf_get along with dma_buf_fd

Browse source 
Use dma_buf_get along with dma_buf_fd on the obtained
fd in order to increment the reference count and avoid
use after free on fd when it is freed from userspace.

CRs-Fixed: 2419587
Change-Id: I57e1396234eebb60224ed58182cca80888e94a9e
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
This commit is contained in:
Aditya Bavanari 2019-03-27 19:15:03 +05:30
commit 36a5eb40be
1 changed files with 20 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
asoc/msm-pcm-q6-noirq.c
View file

@ -445,6 +445,8 @@ static int msm_pcm_mmap_fd(struct snd_pcm_substream *substream,
struct audio_port_data *apd;
struct audio_buffer *ab;
int dir = -1;
struct dma_buf *buf = NULL;
int rc = 0;
if (!substream->runtime) {
pr_err("%s substream runtime not found\n", __func__);
@ -471,12 +473,25 @@ static int msm_pcm_mmap_fd(struct snd_pcm_substream *substream,
* used to call dma_buf_fd internally.
*/
mmap_fd->fd = dma_buf_fd(ab->dma_buf, O_CLOEXEC);
if (mmap_fd->fd >= 0) {
mmap_fd->dir = dir;
mmap_fd->actual_size = ab->actual_size;
mmap_fd->size = ab->size;
if (mmap_fd->fd < 0) {
pr_err("%s: dma_buf_fd failed, fd:%d\n",
__func__, mmap_fd->fd);
rc = -EFAULT;
goto buf_fd_fail;
}
return mmap_fd->fd < 0 ? -EFAULT : 0;
mmap_fd->dir = dir;
mmap_fd->actual_size = ab->actual_size;
mmap_fd->size = ab->size;
buf = dma_buf_get(mmap_fd->fd);
if (IS_ERR_OR_NULL(buf)) {
pr_err("%s: dma_buf_get failed, fd:%d\n",
__func__, mmap_fd->fd);
rc = -EINVAL;
}
buf_fd_fail:
return rc;
}
static int msm_pcm_ioctl(struct snd_pcm_substream *substream,