Skip to content
Commit 84037bf0 authored by Mahesh Voorugonda's avatar Mahesh Voorugonda Committed by Gerrit - the friendly Code Review server
Browse files

msm: vidc: fix msm_comm_get_vidc_buffer fd race issue


In msm_comm_get_vidc_buffer(), we get and manipulate dma_buf
from "fd". But we dont consider the dma-buf can be freed and
recreated from userspace since fd is predictable. As such,
the dma buf we get in "msm_smem_map_dma_buf" may not be the
buffer we verified before. This could lead to type confusion
issues. So added change to hold dma_buf refcount for the
entire msm_comm_get_vidc_buffer() duration.

Change-Id: Ifce821a9a7f95ec45557f7adb1f1bb00efb0151f
Signed-off-by: default avatarGovindaraj Rajagopal <quic_grajagop@quicinc.com>
Signed-off-by: default avatarMahesh Voorugonda <quic_mvoorugo@quicinc.com>
parent 17c0e609
Please register or to comment