Merge "msm: mdss: fix the use after free problem in rotator ioctl" (e9f9e2eb) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/video/msm/mdss/mdss_rotator.c

+11 −1

Original line number	Diff line number	Diff line
		@@ -373,6 +373,15 @@ static bool mdss_rotator_is_work_pending(struct mdss_rot_mgr *mgr,
		return false;
		}

		static void mdss_rotator_install_fence_fd(struct mdss_rot_entry_container *req)
		{
		int i = 0;

		for (i = 0; i < req->count; i++)
		sync_fence_install(req->entries[i].output_fence,
		req->entries[i].output_fence_fd);
		}

		static int mdss_rotator_create_fence(struct mdss_rot_entry *entry)
		{
		int ret = 0, fd;
		@@ -411,7 +420,6 @@ static int mdss_rotator_create_fence(struct mdss_rot_entry *entry)
		goto get_fd_err;
		}

		sync_fence_install(fence, fd);
		rot_timeline->next_value++;
		mutex_unlock(&rot_timeline->lock);

		@@ -2248,6 +2256,7 @@ static int mdss_rotator_handle_request(struct mdss_rot_mgr *mgr,
		goto handle_request_err1;
		}

		mdss_rotator_install_fence_fd(req);
		mdss_rotator_queue_request(mgr, private, req);

		mutex_unlock(&mgr->lock);
		@@ -2408,6 +2417,7 @@ static int mdss_rotator_handle_request32(struct mdss_rot_mgr *mgr,
		goto handle_request32_err1;
		}

		mdss_rotator_install_fence_fd(req);
		mdss_rotator_queue_request(mgr, private, req);

		mutex_unlock(&mgr->lock);