msm: vidc: fix msm_comm_get_vidc_buffer fd race issue
In msm_comm_get_vidc_buffer(), we get and manipulate dma_buf
from "fd". But we dont consider the dma-buf can be freed and
recreated from userspace since fd is predictable. As such,
the dma buf we get in "msm_smem_map_dma_buf" may not be the
buffer we verified before. This could lead to type confusion
issues. So added change to hold dma_buf refcount for the
entire msm_comm_get_vidc_buffer() duration.
Change-Id: Ifce821a9a7f95ec45557f7adb1f1bb00efb0151f
Signed-off-by:
Govindaraj Rajagopal <quic_grajagop@quicinc.com>
Loading
Please register or sign in to comment