Merge "msm: mdp3: fix the use after free problem" (5991af64) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/video/fbdev/msm/mdp3.c

+1 −6

Original line number	Diff line number	Diff line
		/* Copyright (c) 2013-2019,2020 The Linux Foundation. All rights reserved.
		* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
		* Copyright (C) 2007 Google Incorporated
		*
		* This software is licensed under the terms of the GNU General Public
		@@ -1401,17 +1402,12 @@ int mdp3_get_img(struct msmfb_data img, struct mdp3_img_data data, int client)
		&data->len, fb_num);
		if (ret) {
		pr_err("mdss_fb_get_phys_info() failed\n");
		fdput(f);
		memset(&f, 0, sizeof(struct fd));
		}
		} else {
		pr_err("invalid FB_MAJOR\n");
		fdput(f);
		ret = -EINVAL;
		}
		data->srcp_f = f;
		if (!ret)
		goto done;
		} else if (iclient) {
		data->srcp_dma_buf = dma_buf_get(img->memory_id);
		if (IS_ERR(data->srcp_dma_buf)) {
		@@ -1494,7 +1490,6 @@ int mdp3_get_img(struct msmfb_data img, struct mdp3_img_data data, int client)
		data->mapped = true;
		data->skip_detach = false;
		}
		done:
		if (client == MDP3_CLIENT_PPP \|\| client == MDP3_CLIENT_DMA_P) {
		data->addr += data->tab_clone->sgl->length;
		data->len -= data->tab_clone->sgl->length;