msm: camera: smmu: Use get_file to increase ref count
Due to race condition, fd pointing to a particular dma buf
is released by userspace before incrementing ref count and
hence freed that dma buf. When the call returns it still uses
the freed dma buf causing use-after-free.
This fix includes get_file API to increment ref count
before dma_buf_fd.
CRs-Fixed: 3341070
Change-Id: I8ebc37b4ceb5f8691bbbb3d26b8b64878d832fbe
Signed-off-by:
Shivakumar Malke <quic_smalke@quicinc.com>
Loading
Please register or sign in to comment