]> rtime.felk.cvut.cz Git - sojka/nv-tegra/linux-3.10.git/commit
video: tegra: nvmap: fix use-after-free race condition
authorManeet Singh <mmaneetsingh@nvidia.com>
Fri, 12 Sep 2014 03:12:33 +0000 (20:12 -0700)
committerMitch Luban <mluban@nvidia.com>
Tue, 14 Oct 2014 22:02:22 +0000 (15:02 -0700)
commit57abd0b4e27d9bc6a84b18ce28f8aa9200304ec3
treedc1850bf526f732e066dabd2aba34e40ccdbbfd3
parentf6b9afa5944aa2fab077a34c25d57bde46d1f389
video: tegra: nvmap: fix use-after-free race condition

Incremented nvmap_handle ref count in utility function
nvmap_get_id_from_dmabuf_fd() before the function release reference
to dma buffer. This is required to avoid race conditions in nvmap
code where nvmap_handle returned by this function could be freed
concurrently while the caller is still using it.

As a side effect of above change, every caller of this utility
function must decrement nvmap_handle ref count after using the
returned nvmap_handle.

Bug 1553082

Change-Id: Iffc2e5819f8b493d5ed95a9d0c422ccd52438965
Signed-off-by: Maneet Singh <mmaneetsingh@nvidia.com>
Reviewed-on: http://git-master/r/498135
(cherry picked from commit afddea745cc4f4a824be501ecbbb50f55e7e6f04)
Reviewed-on: http://git-master/r/556843
Reviewed-by: Mitch Luban <mluban@nvidia.com>
Tested-by: Mitch Luban <mluban@nvidia.com>
drivers/video/tegra/nvmap/nvmap_dmabuf.c
drivers/video/tegra/nvmap/nvmap_handle.c
drivers/video/tegra/nvmap/nvmap_ioctl.c