msm: vidc: eliminate race condition in dynamic buffer mode
Function get_same_fd_buffer returned a pointer to
registered buffer, which shared the same fd as the
current buffer being mapped. While this buffer was
being accessed in map_and_register_buf(), it was
not guarded by the inst lock. So if the buffer was
erroneously freed, while it's still being accessed
in map_and_register_buf(), we may see a kernel
panic due to garbage values. To avoid this race
condition, introduce more checks in get_same_fd_buffer()
and return only the required handle information back to
map_and_register_buf.
Change-Id: I798c33dc344977c5db3bd74e5f863ca5cda14cb9
Signed-off-by:
Arun Menon <avmenon@codeaurora.org>
Loading
Please register or sign in to comment