Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e13c925 authored by Naseer Ahmed's avatar Naseer Ahmed Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: Install sync fences after user copy 



If userspace closes the fd after an error on copying to
userspace, the fences may be freed incorrectly. Make sure fences
are installed after all checks pass.

Bug: 32402303
Change-Id: Ieb50296c87e09549db2734bd70bb6ee8d311ad40
CRs-Fixed: 2000664
Signed-off-by: default avatarNaseer Ahmed <naseer@codeaurora.org>
parent eb9d158f

drivers/video/msm/mdss/mdss_fb.c

+4 −5
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@ 
 * Core MDSS framebuffer driver.

 *

 * Copyright (C) 2007 Google Incorporated

 * Copyright (c) 2008-2016, The Linux Foundation. All rights reserved.

 * Copyright (c) 2008-2017, The Linux Foundation. All rights reserved.

 *

 * This software is licensed under the terms of the GNU General Public

 * License version 2, as published by the Free Software Foundation, and
@@ -4163,8 +4163,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data, 
		goto buf_sync_err_2;

	}



	sync_fence_install(rel_fence, rel_fen_fd);



	ret = copy_to_user(buf_sync->rel_fen_fd, &rel_fen_fd, sizeof(int));

	if (ret) {

		pr_err("%s: copy_to_user failed\n", sync_pt_data->fence_name);
@@ -4201,8 +4199,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data, 
		goto buf_sync_err_3;

	}



	sync_fence_install(retire_fence, retire_fen_fd);



	ret = copy_to_user(buf_sync->retire_fen_fd, &retire_fen_fd,

			sizeof(int));

	if (ret) {
@@ -4213,6 +4209,9 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data, 
		goto buf_sync_err_3;

	}



	sync_fence_install(rel_fence, rel_fen_fd);

	sync_fence_install(retire_fence, retire_fen_fd);



skip_retire_fence:

	mutex_unlock(&sync_pt_data->sync_mutex);