msm: vidc: fix msm_comm_get_vidc_buffer fd race issue
In msm_comm_get_vidc_buffer(), we get and manipulate dma_buf from "fd". But we dont consider the dma-buf can be freed and recreated from userspace since fd is predictable. As such, the dma buf we get in "msm_smem_map_dma_buf" may not be the buffer we verified before. This could lead to type confusion issues. So added change to hold dma_buf refcount for the entire msm_comm_get_vidc_buffer() duration. Change-Id: Ifce821a9a7f95ec45557f7adb1f1bb00efb0151f Signed-off-by:Govindaraj Rajagopal <quic_grajagop@quicinc.com> Signed-off-by:
Mahesh Voorugonda <quic_mvoorugo@quicinc.com>
parent
17c0e609
Please register or sign in to comment