rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

msm: kgsl: Correct the refcount on current process PID

Browse Source 
In kgsl_process_private_new() function there is inconsistency
in the refcount of current process PID. Fix this to avoid
overflowing of reference counter leading to use after free
of this struct.

Issue: SEC-3014
Change-Id: I6291b9a05e139337e7f8471d0f9409fc839969a3
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
Signed-off-by: Puranam V G Tejaswi <pvgtejas@codeaurora.org>
(cherry-picked from commit https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=d075e70c95d89cba8d716bcba21df565f946fc1f)
This commit is contained in:
Archana Sriram
2021-10-10 23:46:48 +02:00
committed by Francescodario Cuzzocrea
parent f9a569c25e
commit 833cfbd8b1
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/gpu/msm/kgsl.c
+9 -2
View File
@@ -963,17 +963,24 @@ static struct kgsl_process_private *kgsl_process_private_new(void)
list_for_each_entry(private, &kgsl_driver.process_list, list) {
if (private->pid == cur_pid) {
if (!kgsl_process_private_get(private)) {
put_pid(cur_pid);
private = NULL;
}
/*
* We need to hold only one reference to the PID for
* each process struct to avoid overflowing the
* reference counter which can lead to use-after-free.
*/
put_pid(cur_pid);
goto done;
}
}
/* no existing process private found for this dev_priv, create one */
private = kzalloc(sizeof(struct kgsl_process_private), GFP_KERNEL);
if (private == NULL)
if (private == NULL) {
put_pid(cur_pid);
goto done;
}
kref_init(&private->refcount);