From e9d6a3f0a7e45c63b81ec0fe64eed4d5aacbe22b Mon Sep 17 00:00:00 2001 From: Sachin Bhayare Date: Thu, 12 Apr 2018 18:57:52 +0530 Subject: [PATCH] msm: mdss: Increase fbmem buf ref count before use in mdp3 The reference count for fbmem buf is not increased before use, which means it can be get freed unintentionally when the reference count is decreased to "0". In this case, there is possibility of use after free. Ensure that fbmem buf refcount is incremented before use mdp3 driver. Change-Id: I38787c27a26ae550c6fb28697a7583490ad19df8 Signed-off-by: Sachin Bhayare --- drivers/video/fbdev/msm/mdp3_ctrl.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/msm/mdp3_ctrl.c b/drivers/video/fbdev/msm/mdp3_ctrl.c index dff8b63eea64..8a9e8acf6c0e 100644 --- a/drivers/video/fbdev/msm/mdp3_ctrl.c +++ b/drivers/video/fbdev/msm/mdp3_ctrl.c @@ -1564,12 +1564,15 @@ static int mdp3_get_metadata(struct msm_fb_data_type *mfd, break; case metadata_op_get_ion_fd: if (mfd->fb_ion_handle && mfd->fb_ion_client) { + get_dma_buf(mfd->fbmem_buf); metadata->data.fbmem_ionfd = ion_share_dma_buf_fd(mfd->fb_ion_client, mfd->fb_ion_handle); - if (metadata->data.fbmem_ionfd < 0) + if (metadata->data.fbmem_ionfd < 0) { + dma_buf_put(mfd->fbmem_buf); pr_err("fd allocation failed. fd = %d\n", - metadata->data.fbmem_ionfd); + metadata->data.fbmem_ionfd); + } } break; default: -- 2.11.0