mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-10 22:40:54 -04:00
No description
- C 98.2%
- Assembly 1%
- Makefile 0.3%
- Shell 0.2%
- Python 0.1%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
3fedfd9225
Use after free can happen in below scenario. [1] In msm_vidc_open, When instance count reaches max count or when open failed it waits for core lock before removing instance from instance list. [2] During this time backward thread can get invoked to handle firmware response for cmds, It increments reference count and gets instance. [3] If forward thread resumes after this, and frees intance, backward thread will end up using freed instance. [4] To address this, calling kref_put(&inst->kref) and freeing instance immediately if ref count is zero, if recount is not zero, backward thread frees instance memory in put_inst_helper. Change-Id: I58c81d4d9fda1523d0fa29ebdb33455db839d46f Signed-off-by: Vasantha Balla <quic_c_vballa@quicinc.com> (cherry picked from commit ccddad0c4992ab7b4e3651e2c5c8df3e79bb7c43) (cherry picked from commit cc9f3cc50311796626b2c40b049daeef0a5719ea) |
||
| config | ||
| include/uapi/vidc/media | ||
| msm | ||
| Makefile | ||