From 79c14fa64191b69840df2055dfba906ab9d33e51 Mon Sep 17 00:00:00 2001 From: gaowang Date: Tue, 24 Sep 2024 16:19:44 +0800 Subject: [PATCH] msm: virtio_npu: Fix use-after-free issue in virt_npu_map_buf address the security CR of virtio_npu driver Change-Id: Ib77014bc12490e7b09367354024baa2754d3e433 Signed-off-by: gaowang --- drivers/media/platform/msm/npu/virtio_npu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/msm/npu/virtio_npu.c b/drivers/media/platform/msm/npu/virtio_npu.c index bed8eac6fe68..e21427f53734 100644 --- a/drivers/media/platform/msm/npu/virtio_npu.c +++ b/drivers/media/platform/msm/npu/virtio_npu.c @@ -814,6 +814,7 @@ static int32_t virt_npu_map_buf(struct npu_client *client, struct npu_ion_buf *ion_buf = NULL; int rc = 0; + mutex_lock(&npu_dev->lock); ion_buf = npu_alloc_npu_ion_buffer(client, buf_hdl, size); if (!ion_buf) { NPU_ERR("fail to alloc npu_ion_buffer\n"); @@ -853,6 +854,7 @@ static int32_t virt_npu_map_buf(struct npu_client *client, rc = virt_npu_mmap(client, 0, ion_buf->table->sgl, ion_buf->table->nents, size, &ion_buf->iova); + mutex_unlock(&npu_dev->lock); map_end: if (rc)