A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 03:45:24 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "crypto: qcedev - fix UAF in crypto-qti driver"

Browse source
This commit is contained in:
QCTECMDR Service 2025-06-10 09:44:35 -07:00 • committed by Gerrit - the friendly Code Review server
commit 7d950bc07d
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
drivers/crypto/msm/qcedev_smmu.c
View file

@ -329,10 +329,6 @@ int qcedev_check_and_map_buffer(void *handle,
mapped_size = binfo->ion_buf.mapped_buf_size;
atomic_inc(&binfo->ref_count);
/* Add buffer mapping information to regd buffer list */
mutex_lock(&qce_hndl->registeredbufs.lock);
list_add_tail(&binfo->list, &qce_hndl->registeredbufs.list);
mutex_unlock(&qce_hndl->registeredbufs.lock);
}
/* Make sure the offset is within the mapped range */
@ -344,6 +340,13 @@ int qcedev_check_and_map_buffer(void *handle,
goto unmap;
}
if (!found) {
/* Add buffer mapping information to regd buffer list */
mutex_lock(&qce_hndl->registeredbufs.lock);
list_add_tail(&binfo->list, &qce_hndl->registeredbufs.list);
mutex_unlock(&qce_hndl->registeredbufs.lock);
}
/* return the mapped virtual address adjusted by offset */
*vaddr += offset;
@ -352,9 +355,6 @@ int qcedev_check_and_map_buffer(void *handle,
unmap:
if (!found) {
qcedev_unmap_buffer(handle, mem_client, binfo);
mutex_lock(&qce_hndl->registeredbufs.lock);
list_del(&binfo->list);
mutex_unlock(&qce_hndl->registeredbufs.lock);
}
error: