Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0dc228c2 authored by Archana Sriram's avatar Archana Sriram Committed by Gerrit - the friendly Code Review server
Browse files

msm: kgsl: Correct the refcount on current process PID 



In kgsl_process_private_new() function there is inconsistency
in the refcount of current process PID. Fix this to avoid
overflowing of reference counter leading to use after free
of this struct.

Change-Id: I6291b9a05e139337e7f8471d0f9409fc839969a3
Signed-off-by: default avatarArchana Sriram <apsrir@codeaurora.org>
parent 1ece9bbc

drivers/gpu/msm/kgsl.c

+9 −2
Original line number Diff line number Diff line
@@ -916,17 +916,24 @@ static struct kgsl_process_private *kgsl_process_private_new( 
	list_for_each_entry(private, &kgsl_driver.process_list, list) {

		if (private->pid == cur_pid) {

			if (!kgsl_process_private_get(private)) {

				put_pid(cur_pid);

				private = ERR_PTR(-EINVAL);

			}

			/*

			 * We need to hold only one reference to the PID for

			 * each process struct to avoid overflowing the

			 * reference counter which can lead to use-after-free.

			 */

			put_pid(cur_pid);

			return private;

		}

	}



	/* Create a new object */

	private = kzalloc(sizeof(struct kgsl_process_private), GFP_KERNEL);

	if (private == NULL)

	if (private == NULL) {

		put_pid(cur_pid);

		return ERR_PTR(-ENOMEM);

	}



	kref_init(&private->refcount);