samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: eva: Fix DMA-BUF double free

Browse Source 
msm_cvp_smem_put_dma_buf() releases the EVA driver's reference it uses
for DMA mappings, by decrementing the refcount of the underlying
struct file that all DMA-BUFs use for life cycle tracking. By
accident, the EVA driver held a direct reference to the underlying
file using the struct msm_cvp_smem->file variable. The EVA driver,
after releasing it's reference to the DMA-BUF, inadvertently called
fput() on the struct_cvp_smem->file variable, which leads to a double
free.

Resolve this by removing the struct msm_cvp_smmem->file variable, and
by removing the corresponding fput().

Change-Id: I108cd87509673008ff55fc94fda76aa21f21bd5d
Signed-off-by: Chris Goldsworthy <cgoldswo@codeaurora.org>
This commit is contained in:
Chris Goldsworthy
2021-07-30 10:13:52 -07:00
parent d6bee86fa3
commit 30223d90a7
2 changed files with 0 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
msm/eva/msm_cvp_buf.c
View File

@@ -214,7 +214,6 @@ int msm_cvp_map_buf_dsp(struct msm_cvp_inst *inst, struct eva_kmd_buffer *buf)
}
smem->dma_buf = dma_buf;
smem->file = file;
smem->bitmap_index = MAX_DMABUF_NUMS;
dprintk(CVP_MEM, "%s: dma_buf = %llx\n", __func__, dma_buf);
rc = msm_cvp_map_smem(inst, smem, "map dsp");
@@ -287,7 +286,6 @@ int msm_cvp_unmap_buf_dsp(struct msm_cvp_inst *inst, struct eva_kmd_buffer *buf)
if (cbuf->smem->device_addr) {
msm_cvp_unmap_smem(inst, cbuf->smem, "unmap dsp");
msm_cvp_smem_put_dma_buf(cbuf->smem->dma_buf);
fput(cbuf->smem->file);
}
mutex_lock(&inst->cvpdspbufs.lock);