evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: Install sync fences after user copy

Browse source 
If userspace closes the fd after an error on copying to
userspace, the fences may be freed incorrectly. Make sure fences
are installed after all checks pass.

Bug: 32402303
Change-Id: Ieb50296c87e09549db2734bd70bb6ee8d311ad40
CRs-Fixed: 2000664
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
This commit is contained in:
Naseer Ahmed 2017-02-01 16:24:01 -05:00 • committed by Gerrit - the friendly Code Review server
parent 3a7e752617
commit c9fe551c93
1 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/video/fbdev/msm/mdss_fb.c
View file

@ -4276,8 +4276,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,
goto buf_sync_err_2;
}
sync_fence_install(rel_fence, rel_fen_fd);
ret = copy_to_user(buf_sync->rel_fen_fd, &rel_fen_fd, sizeof(int));
if (ret) {
pr_err("%s: copy_to_user failed\n", sync_pt_data->fence_name);
@ -4314,8 +4312,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,
goto buf_sync_err_3;
}
sync_fence_install(retire_fence, retire_fen_fd);
ret = copy_to_user(buf_sync->retire_fen_fd, &retire_fen_fd,
sizeof(int));
if (ret) {
@ -4326,6 +4322,9 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,
goto buf_sync_err_3;
}
sync_fence_install(rel_fence, rel_fen_fd);
sync_fence_install(retire_fence, retire_fen_fd);
skip_retire_fence:
mutex_unlock(&sync_pt_data->sync_mutex);