From 374cf47171076659ea3bdfd9d62bee601e80e41b Mon Sep 17 00:00:00 2001 From: Pankaj Gupta Date: Tue, 19 Aug 2025 11:00:16 +0530 Subject: [PATCH] kgsl: Avoid use after free in kgsl_destroy_ion() When deallocating dma-buf metadata in kgsl_destroy_ion, the priv_data pointer in the associated kgsl_mem_entry structure is not reset after kfree(). To avoid use after free, set entry->priv_data to NULL immediately after freeing metadata. Change-Id: Ia222d3a88666b7ee406f1508eb37a4eef766c83e Signed-off-by: Shiv Kumar Signed-off-by: Pankaj Gupta --- drivers/gpu/msm/kgsl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c index 2082d4f27f83..0699fdadade3 100644 --- a/drivers/gpu/msm/kgsl.c +++ b/drivers/gpu/msm/kgsl.c @@ -355,6 +355,7 @@ static void kgsl_destroy_ion(struct kgsl_memdesc *memdesc) } memdesc->sgt = NULL; + entry->priv_data = NULL; } static const struct kgsl_memdesc_ops kgsl_dmabuf_ops = {