From 1babb91a340d41e42ec8856039d6448573eb9f2d Mon Sep 17 00:00:00 2001 From: Gopireddy Arunteja Reddy Date: Wed, 6 Mar 2024 23:41:05 +0530 Subject: [PATCH] msm: eva: User after free fix in msm_cvp_mark_user_persist Update buffer ktid inside mutex protetion. Change-Id: I86767eb60e1f78e373233c0f64c3b5a2249cba0e Signed-off-by: Gopireddy Arunteja Reddy --- drivers/media/platform/msm/cvp/msm_cvp_buf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/msm/cvp/msm_cvp_buf.c b/drivers/media/platform/msm/cvp/msm_cvp_buf.c index 9b9dbd456c42..995c111edb7d 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp_buf.c +++ b/drivers/media/platform/msm/cvp/msm_cvp_buf.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include "msm_cvp_common.h" @@ -643,9 +644,10 @@ int msm_cvp_mark_user_persist(struct msm_cvp_inst *inst, list_for_each_entry_safe(pbuf, dummy, &inst->persistbufs.list, list) { if (pbuf->ownership == CLIENT) { - if (pbuf->fd == buf->fd && - pbuf->size == buf->size) + if (pbuf->fd == buf->fd && pbuf->size == buf->size) { buf->fd = pbuf->smem->device_addr; + pbuf->ktid = ktid; + } rc = 1; break; } @@ -657,7 +659,6 @@ int msm_cvp_mark_user_persist(struct msm_cvp_inst *inst, rc = -EFAULT; break; } - pbuf->ktid = ktid; rc = 0; } return rc;