A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 21:54:34 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: kgsl: Correct the refcount on current process PID

Browse source 
In kgsl_process_private_new() function there is inconsistency
in the refcount of current process PID. Fix this to avoid
overflowing of reference counter leading to use after free
of this struct.

Change-Id: I6291b9a05e139337e7f8471d0f9409fc839969a3
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
This commit is contained in:
Archana Sriram 2020-12-14 16:55:35 +05:30
commit f25b491db8
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
drivers/gpu/msm/kgsl.c
View file

@ -841,17 +841,24 @@ static struct kgsl_process_private *kgsl_process_private_new(
list_for_each_entry(private, &kgsl_driver.process_list, list) {
if (private->pid == cur_pid) {
if (!kgsl_process_private_get(private)) {
put_pid(cur_pid);
private = ERR_PTR(-EINVAL);
}
/*
* We need to hold only one reference to the PID for
* each process struct to avoid overflowing the
* reference counter which can lead to use-after-free.
*/
put_pid(cur_pid);
return private;
}
}
/* Create a new object */
private = kzalloc(sizeof(struct kgsl_process_private), GFP_KERNEL);
if (private == NULL)
if (private == NULL) {
put_pid(cur_pid);
return ERR_PTR(-ENOMEM);
}
kref_init(&private->refcount);