diff options
| author | Mark Yao <mark.yao@rock-chips.com> | 2016-06-26 21:49:21 -0400 |
|---|---|---|
| committer | Chih-Wei Huang <cwhuang@linux.org.tw> | 2016-07-06 11:42:52 +0800 |
| commit | a9d0cbf474511070c13990b1a1ba7a22bba62b8e (patch) | |
| tree | 219441540ad848bab090174621036e0a59e00aa8 | |
| parent | 27d5b5a271f7ec71444030e5f15799993244645d (diff) | |
| download | external_drm_gralloc-a9d0cbf474511070c13990b1a1ba7a22bba62b8e.zip external_drm_gralloc-a9d0cbf474511070c13990b1a1ba7a22bba62b8e.tar.gz external_drm_gralloc-a9d0cbf474511070c13990b1a1ba7a22bba62b8e.tar.bz2 | |
drm_gralloc: fix random crash with wildpointer
two drm handle may use same bo, but there is no
reference protect. if one of the drm handle release
the bo, another handle's bo become a wildpointer,
any read/write on the wildpointer will cause system
unstable, crash.
Change-Id: Ieaca522e3372dba82c48961499b9b657ca33cd15
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
| -rw-r--r-- | gralloc_drm.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/gralloc_drm.c b/gralloc_drm.c index 23815bb..40342cb 100644 --- a/gralloc_drm.c +++ b/gralloc_drm.c @@ -235,7 +235,15 @@ static struct gralloc_drm_bo_t *validate_handle(buffer_handle_t _handle, */ int gralloc_drm_handle_register(buffer_handle_t handle, struct gralloc_drm_t *drm) { - return (validate_handle(handle, drm)) ? 0 : -EINVAL; + struct gralloc_drm_bo_t *bo; + + bo = validate_handle(handle, drm); + if (!bo) + return -EINVAL; + + bo->refcount++; + + return 0; } /* @@ -249,6 +257,7 @@ int gralloc_drm_handle_unregister(buffer_handle_t handle) if (!bo) return -EINVAL; + gralloc_drm_bo_decref(bo); if (bo->imported) gralloc_drm_bo_decref(bo); |