Merge "msm: kgsl: Correct the refcount on current process PID"
diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c
index 6053d29..cc97838 100644
--- a/drivers/gpu/msm/kgsl.c
+++ b/drivers/gpu/msm/kgsl.c
@@ -916,17 +916,24 @@
list_for_each_entry(private, &kgsl_driver.process_list, list) {
if (private->pid == cur_pid) {
if (!kgsl_process_private_get(private)) {
- put_pid(cur_pid);
private = ERR_PTR(-EINVAL);
}
+ /*
+ * We need to hold only one reference to the PID for
+ * each process struct to avoid overflowing the
+ * reference counter which can lead to use-after-free.
+ */
+ put_pid(cur_pid);
return private;
}
}
/* Create a new object */
private = kzalloc(sizeof(struct kgsl_process_private), GFP_KERNEL);
- if (private == NULL)
+ if (private == NULL) {
+ put_pid(cur_pid);
return ERR_PTR(-ENOMEM);
+ }
kref_init(&private->refcount);