diff options
| author | Rebecca Schultz Zavin <rebecca@android.com> | 2011-07-07 17:07:56 -0700 |
|---|---|---|
| committer | Dan Willemsen <dwillemsen@nvidia.com> | 2011-11-30 21:38:48 -0800 |
| commit | 46c6ecaae93b4087d895f1a9f36d95ad6d8fd3f2 (patch) | |
| tree | f9099aba638be2912230c5742c3baace31a0cdd6 /drivers/gpu | |
| parent | 3221425cb5f44324c163a881bf7aa659f3eb2974 (diff) | |
gpu: ion: Validate handles passed via the kernel api
Before freeing or sharing handles, confirm that they
are valid in the provided client
Change-Id: I06ec599c0b277fcb5417325a12ecbf8b2d248a7b
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/ion/ion.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/drivers/gpu/ion/ion.c b/drivers/gpu/ion/ion.c index 1c25940a1fd1..9cb5b25bb110 100644 --- a/drivers/gpu/ion/ion.c +++ b/drivers/gpu/ion/ion.c @@ -333,6 +333,18 @@ end: void ion_free(struct ion_client *client, struct ion_handle *handle) { + bool valid_handle; + + BUG_ON(client != handle->client); + + mutex_lock(&client->lock); + valid_handle = ion_handle_validate(client, handle); + mutex_unlock(&client->lock); + + if (!valid_handle) { + WARN("%s: invalid handle passed to free.\n", __func__); + return; + } ion_handle_put(handle); } @@ -500,6 +512,16 @@ void ion_unmap_dma(struct ion_client *client, struct ion_handle *handle) struct ion_buffer *ion_share(struct ion_client *client, struct ion_handle *handle) { + bool valid_handle; + + mutex_lock(&client->lock); + valid_handle = ion_handle_validate(client, handle); + mutex_unlock(&client->lock); + if (!valid_handle) { + WARN("%s: invalid handle passed to share.\n", __func__); + return ERR_PTR(-EINVAL); + } + /* don't not take an extra refernce here, the burden is on the caller * to make sure the buffer doesn't go away while it's passing it * to another client -- ion_free should not be called on this handle |