Merge "msm: eva: User after free fix in msm_cvp_mark_user_persist" (edd54a32) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/media/platform/msm/cvp/msm_cvp_buf.c

+4 −3

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2020, The Linux Foundation. All rights reserved.
		* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
		*/

		#include "msm_cvp_common.h"
		@@ -643,9 +644,10 @@ int msm_cvp_mark_user_persist(struct msm_cvp_inst *inst,
		list_for_each_entry_safe(pbuf, dummy, &inst->persistbufs.list,
		list) {
		if (pbuf->ownership == CLIENT) {
		if (pbuf->fd == buf->fd &&
		pbuf->size == buf->size)
		if (pbuf->fd == buf->fd && pbuf->size == buf->size) {
		buf->fd = pbuf->smem->device_addr;
		pbuf->ktid = ktid;
		}
		rc = 1;
		break;
		}
		@@ -657,7 +659,6 @@ int msm_cvp_mark_user_persist(struct msm_cvp_inst *inst,
		rc = -EFAULT;
		break;
		}
		pbuf->ktid = ktid;
		rc = 0;
		}
		return rc;