Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 08520107 authored by Jilai Wang's avatar Jilai Wang
Browse files

msm: npu: Prevent network from being used after free 



Function wait_for_completion_interruptible_timeout will return after
receiving a signal which would cause the network data structure to be
used after it is freed. This change is to handle this scenario properly
to avoid use-after-free issue.

Change-Id: Icb74b3e7a5cb6c3201738c1952948d308333993e
Signed-off-by: default avatarJilai Wang <jilaiw@codeaurora.org>
parent cf4e0244

drivers/media/platform/msm/npu/npu_dev.c

+5 −5
Original line number Diff line number Diff line
@@ -957,7 +957,7 @@ static int npu_load_network(struct npu_client *client, 


	ret = npu_host_load_network(client, &req);

	if (ret) {

		pr_err("network load failed: %d\n", ret);

		pr_err("npu_host_load_network failed %d\n", ret);

		return ret;

	}
@@ -1014,7 +1014,7 @@ static int npu_load_network_v2(struct npu_client *client, 


	kfree(patch_info);

	if (ret) {

		pr_err("network load failed: %d\n", ret);

		pr_err("npu_host_load_network_v2 failed %d\n", ret);

		return ret;

	}
@@ -1046,7 +1046,7 @@ static int npu_unload_network(struct npu_client *client, 
	ret = npu_host_unload_network(client, &req);



	if (ret) {

		pr_err("npu_host_unload_network failed\n");

		pr_err("npu_host_unload_network failed %d\n", ret);

		return ret;

	}
@@ -1084,7 +1084,7 @@ static int npu_exec_network(struct npu_client *client, 
	ret = npu_host_exec_network(client, &req);



	if (ret) {

		pr_err("npu_host_exec_network failed\n");

		pr_err("npu_host_exec_network failed %d\n", ret);

		return ret;

	}
@@ -1143,7 +1143,7 @@ static int npu_exec_network_v2(struct npu_client *client, 


	kfree(patch_buf_info);

	if (ret) {

		pr_err("npu_host_exec_network failed\n");

		pr_err("npu_host_exec_network_v2 failed %d\n", ret);

		return ret;

	}

drivers/media/platform/msm/npu/npu_mgr.c

+363 −104

File changed.

Preview size limit exceeded, changes collapsed.

drivers/media/platform/msm/npu/npu_mgr.h

+3 −0
Original line number Diff line number Diff line
@@ -54,7 +54,10 @@ struct npu_network { 
	void *stats_buf;

	void __user *stats_buf_u;

	uint32_t stats_buf_size;

	uint32_t trans_id;

	atomic_t ref_cnt;

	bool is_valid;

	bool is_active;

	bool fw_error;

	bool cmd_pending;

	bool cmd_async;