Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0a5fdc0f authored by Jayaprakash's avatar Jayaprakash
Browse files

disp: msm: sde: increment refcount of dma_fence before access 



Add changes to increment refcount of dma_fence before accessing
the input_fence structure in plane_state through debug_fs node and
decrement once access is finished. This prevents the use after free
issues when accessed through debug_fs node.

Change-Id: I262336ce2b86a94d7662d834e8fd3509dadda1bd
Signed-off-by: default avatarJayaprakash <jmadiset@codeaurora.org>
parent a27dce97

msm/sde/sde_crtc.c

+12 −4
Original line number Diff line number Diff line
@@ -6151,10 +6151,18 @@ static int _sde_debugfs_fence_status_show(struct seq_file *s, void *data) 
		seq_printf(s, "plane:%u stage:%d\n", plane->base.id,

			pstate->stage);



		fence = pstate->input_fence;

		SDE_EVT32(DRMID(crtc), fence);

		if (fence)

		SDE_EVT32(DRMID(crtc), plane->base.id, pstate->input_fence);

		if (pstate->input_fence) {



			rcu_read_lock();

			fence = dma_fence_get_rcu(pstate->input_fence);

			rcu_read_unlock();



			if (fence) {

				sde_fence_list_dump(fence, &s);

				dma_fence_put(fence);

			}

		}

	}



	/* Dump release fence info */