diff options
| author | Krishna Manikandan <mkrishn@codeaurora.org> | 2017-07-19 10:30:47 +0530 |
|---|---|---|
| committer | Krishna Manikandan <mkrishn@codeaurora.org> | 2017-07-19 10:31:16 +0530 |
| commit | 97e44bbbabe93794b53e77047ed8eda3a3c9af67 (patch) | |
| tree | 3e0386095cf3347029785cf4db59bc2d98e6893b /drivers/video/fbdev | |
| parent | 8069e32933941719997cc855a82c2088ffb5382f (diff) | |
msm: mdss: fix the use after free problem in rotator ioctl
Currently the fence fd is installed too early. This can cause a
use after free problem if the fence fd is closed in some other thread.
This change will install the fence fd where it is required and
eliminates the problem.
Change-Id: I5cf585ea87ef75fccae06da6cb5a6c16fc74eff3
Signed-off-by: Harsh Sahu <hsahu@codeaurora.org>
Signed-off-by: Krishna Manikandan <mkrishn@codeaurora.org>
Diffstat (limited to 'drivers/video/fbdev')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_rotator.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/drivers/video/fbdev/msm/mdss_rotator.c b/drivers/video/fbdev/msm/mdss_rotator.c index 61b0518d3ee6..2028222748c3 100644 --- a/drivers/video/fbdev/msm/mdss_rotator.c +++ b/drivers/video/fbdev/msm/mdss_rotator.c @@ -373,6 +373,15 @@ static bool mdss_rotator_is_work_pending(struct mdss_rot_mgr *mgr, return false; } +static void mdss_rotator_install_fence_fd(struct mdss_rot_entry_container *req) +{ + int i = 0; + + for (i = 0; i < req->count; i++) + sync_fence_install(req->entries[i].output_fence, + req->entries[i].output_fence_fd); +} + static int mdss_rotator_create_fence(struct mdss_rot_entry *entry) { int ret = 0, fd; @@ -411,7 +420,6 @@ static int mdss_rotator_create_fence(struct mdss_rot_entry *entry) goto get_fd_err; } - sync_fence_install(fence, fd); rot_timeline->next_value++; mutex_unlock(&rot_timeline->lock); @@ -2240,6 +2248,7 @@ static int mdss_rotator_handle_request(struct mdss_rot_mgr *mgr, goto handle_request_err1; } + mdss_rotator_install_fence_fd(req); mdss_rotator_queue_request(mgr, private, req); mutex_unlock(&mgr->lock); @@ -2400,6 +2409,7 @@ static int mdss_rotator_handle_request32(struct mdss_rot_mgr *mgr, goto handle_request32_err1; } + mdss_rotator_install_fence_fd(req); mdss_rotator_queue_request(mgr, private, req); mutex_unlock(&mgr->lock); |