Skip to content
Snippets Groups Projects
Commit 04c3b620 authored by shunmin_wang's avatar shunmin_wang Committed by Carol_Jiang
Browse files

anthias: secutiry patch for ANDROID-28084795 (CVE-2016-2503)

Change-Id: Ic58bcaf01ae999c173a3ccd0523f79aafcca7267
Reviewed-on: http://mcrd1-22-pc.corpnet.asus/code-review/master/236400


Reviewed-by: default avatarshunmin_wang <shunmin_wang@asus.com>
Tested-by: default avatarshunmin_wang <shunmin_wang@asus.com>
parent c6296479
No related branches found
No related tags found
No related merge requests found
......@@ -402,12 +402,13 @@ long kgsl_ioctl_syncsource_create(struct kgsl_device_private *dev_priv,
goto out;
}
kref_init(&syncsource->refcount);
syncsource->private = private;
mutex_lock(&private->process_private_mutex);
id = idr_alloc(&private->syncsource_idr, syncsource, 1, 0, GFP_KERNEL);
if (id > 0) {
kref_init(&syncsource->refcount);
syncsource->id = id;
syncsource->private = private;
param->id = id;
ret = 0;
......@@ -415,6 +416,8 @@ long kgsl_ioctl_syncsource_create(struct kgsl_device_private *dev_priv,
ret = id;
}
mutex_unlock(&private->process_private_mutex);
idr_preload_end();
out:
if (ret) {
if (syncsource && syncsource->oneshot)
......@@ -472,25 +475,24 @@ long kgsl_ioctl_syncsource_destroy(struct kgsl_device_private *dev_priv,
{
struct kgsl_syncsource_destroy *param = data;
struct kgsl_syncsource *syncsource = NULL;
struct kgsl_process_private *private;
syncsource = kgsl_syncsource_get(dev_priv->process_priv,
param->id);
struct kgsl_process_private *private = dev_priv->process_priv;
if (syncsource == NULL)
return -EINVAL;
mutex_lock(&private->process_private_mutex);
syncsource = idr_find(&private->syncsource_idr, param->id);
private = syncsource->private;
if (syncsource) {
idr_remove(&private->syncsource_idr, param->id);
syncsource->id = 0;
}
mutex_lock(&private->process_private_mutex);
idr_remove(&private->syncsource_idr, param->id);
syncsource->id = 0;
mutex_unlock(&private->process_private_mutex);
if (syncsource == NULL)
return -EINVAL;
/* put reference from syncsource creation */
kgsl_syncsource_put(syncsource);
/* put reference from getting the syncsource above */
kgsl_syncsource_put(syncsource);
return 0;
}
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment