evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: Increase fbmem buf ref count before use

Browse source 
The reference count for fbmem buf is not increased before use,
which means it can be get freed unintentionally when the reference
count is decreased to "0". In this case, there is possibility of
use after free. Ensure that fbmem buf refcount is incremented
before use.

Change-Id: I525d41e5496a1123e53a438b5f78d4da8bc046bd
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
This commit is contained in:
Jayant Shekhar 2017-06-22 11:46:47 +05:30
parent 560a996da5
commit ec3a993112
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/video/fbdev/msm/mdss_mdp_overlay.c
View file

@ -4988,12 +4988,15 @@ static int mdss_fb_get_metadata(struct msm_fb_data_type *mfd,
break;
case metadata_op_get_ion_fd:
if (mfd->fb_ion_handle && mfd->fb_ion_client) {
get_dma_buf(mfd->fbmem_buf);
metadata->data.fbmem_ionfd =
ion_share_dma_buf_fd(mfd->fb_ion_client,
mfd->fb_ion_handle);
if (metadata->data.fbmem_ionfd < 0)
if (metadata->data.fbmem_ionfd < 0) {
dma_buf_put(mfd->fbmem_buf);
pr_err("fd allocation failed. fd = %d\n",
metadata->data.fbmem_ionfd);
}
}
break;
case metadata_op_crc: