History

dma-buf: Fix one use-after-free of fence

Need get the new fence when we replace the old one.

xinhui pan committed 4 years ago

Commit 7c1aeba1 parent 9fc33ea1 file · +1 −1Browse files

Unified · Split

drivers/dma-buf/dma-resv.c+1−1
@@ -343,7 +343,7 @@ void dma_resv_replace_fences(struct dma_resv *obj, uint64_t context, · 342 unmodified lines
343343 if (old->context != context)
344344 continue;
345345
346− dma_resv_list_set(list, i, replacement, usage);
346+ dma_resv_list_set(list, i, dma_fence_get(replacement), usage);
347347 dma_fence_put(old);
348348 }
349349 }