summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMark Yao <mark.yao@rock-chips.com>2016-06-26 21:49:21 -0400
committerChih-Wei Huang <cwhuang@linux.org.tw>2016-07-06 11:42:52 +0800
commita9d0cbf474511070c13990b1a1ba7a22bba62b8e (patch)
tree219441540ad848bab090174621036e0a59e00aa8
parent27d5b5a271f7ec71444030e5f15799993244645d (diff)
downloadexternal_drm_gralloc-a9d0cbf474511070c13990b1a1ba7a22bba62b8e.zip
external_drm_gralloc-a9d0cbf474511070c13990b1a1ba7a22bba62b8e.tar.gz
external_drm_gralloc-a9d0cbf474511070c13990b1a1ba7a22bba62b8e.tar.bz2
drm_gralloc: fix random crash with wildpointer
two drm handle may use same bo, but there is no reference protect. if one of the drm handle release the bo, another handle's bo become a wildpointer, any read/write on the wildpointer will cause system unstable, crash. Change-Id: Ieaca522e3372dba82c48961499b9b657ca33cd15 Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
-rw-r--r--gralloc_drm.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/gralloc_drm.c b/gralloc_drm.c
index 23815bb..40342cb 100644
--- a/gralloc_drm.c
+++ b/gralloc_drm.c
@@ -235,7 +235,15 @@ static struct gralloc_drm_bo_t *validate_handle(buffer_handle_t _handle,
*/
int gralloc_drm_handle_register(buffer_handle_t handle, struct gralloc_drm_t *drm)
{
- return (validate_handle(handle, drm)) ? 0 : -EINVAL;
+ struct gralloc_drm_bo_t *bo;
+
+ bo = validate_handle(handle, drm);
+ if (!bo)
+ return -EINVAL;
+
+ bo->refcount++;
+
+ return 0;
}
/*
@@ -249,6 +257,7 @@ int gralloc_drm_handle_unregister(buffer_handle_t handle)
if (!bo)
return -EINVAL;
+ gralloc_drm_bo_decref(bo);
if (bo->imported)
gralloc_drm_bo_decref(bo);