diff options
| author | Daniel Rosenberg <drosen@google.com> | 2016-11-02 17:43:51 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-01-10 14:08:32 -0800 |
| commit | c7adff7a0cedd39a64f3f06b1d8a4be59a6a0bd5 (patch) | |
| tree | 98ffdf18e3d27739c18d15acc0449bbbdab50ceb /tools/perf/scripts/python | |
| parent | 0a8e939a4e57d86da88c9856cd266447fc45ea85 (diff) | |
ion: Fix use after free during ION_IOC_ALLOC
If a user happens to call ION_IOC_FREE during an
ION_IOC_ALLOC on the just allocated id, and the
copy_to_user fails, the cleanup code will attempt
to free an already freed handle.
This adds a wrapper for ion_alloc that adds an
ion_handle_get to avoid this.
Bug: 31568617
Change-Id: I476e5bd5372b5178a213f1fea143d270cf9361ed
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Git-repo: https://android.googlesource.com/kernel/msm/
Git-commit: 20a5411d0115b16826f3d327b6abb0192c8a2001
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions