From 6e8693a6ef56f9e9fc6d370c4511ecfa4e7adef1 Mon Sep 17 00:00:00 2001 From: Narendra Muppalla Date: Tue, 25 Aug 2020 15:57:59 -0700 Subject: [PATCH] disp: msm: sde: return latest rsvp_next pointer on poll timeouts To avoid use after free issues this change gets latest rsvp_next pointer in poll timeout scenario. Change-Id: I4bd4ce1ce9d4f5f2df0e814ceb8babe544578fc6 Signed-off-by: Narendra Muppalla --- msm/sde/sde_rm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/msm/sde/sde_rm.c b/msm/sde/sde_rm.c index 15cdb906c598..20e1dc9473f2 100644 --- a/msm/sde/sde_rm.c +++ b/msm/sde/sde_rm.c @@ -2389,8 +2389,8 @@ struct sde_rm_rsvp *_sde_rm_poll_get_rsvp_nxt_locked(struct sde_rm *rm, usleep_range(sleep, sleep * 2); mutex_lock(&rm->rm_lock); } - - return rsvp_nxt; + /* make sure to get latest rsvp_next to avoid use after free issues */ + return _sde_rm_get_rsvp_nxt(rm, enc); } int sde_rm_reserve(