A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:22:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "msm: vidc: resolve use-after-free problem"

Browse source
This commit is contained in:
qctecmdr 2020-10-30 16:47:10 -07:00 • committed by Gerrit - the friendly Code Review server
commit a9c461984c
1 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

20
msm/vidc/msm_vidc.c
View file

@ -1476,6 +1476,14 @@ static struct msm_vidc_inst_smem_ops msm_vidc_smem_ops = {
.smem_drain = msm_smem_memory_drain,
};
static void close_helper(struct kref *kref)
{
struct msm_vidc_inst *inst = container_of(kref,
struct msm_vidc_inst, kref);
msm_vidc_destroy(inst);
}
void *msm_vidc_open(int core_id, int session_type)
{
struct msm_vidc_inst *inst = NULL;
@ -1598,7 +1606,9 @@ void *msm_vidc_open(int core_id, int session_type)
if (rc) {
s_vpr_e(inst->sid,
"Failed to move video instance to init state\n");
goto fail_init;
kref_put(&inst->kref, close_helper);
inst = NULL;
goto err_invalid_core;
}
if (msm_comm_check_for_inst_overload(core)) {
@ -1786,14 +1796,6 @@ int msm_vidc_destroy(struct msm_vidc_inst *inst)
return 0;
}
static void close_helper(struct kref *kref)
{
struct msm_vidc_inst *inst = container_of(kref,
struct msm_vidc_inst, kref);
msm_vidc_destroy(inst);
}
int msm_vidc_close(void *instance)
{
struct msm_vidc_inst *inst = instance;