Lee Jones 1029ef8466 ion: Do not 'put' ION handle until after its final use ...

pass_to_user() eventually calls kref_put() on an ION handle which is
still live, potentially allowing for it to be legitimately freed by
the client.

Prevent this from happening before its final use in both ION_IOC_ALLOC
and ION_IOC_IMPORT.

Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-16 12:34:30 +09:00

..

fiq_debugger

ANDROID: fiq_debugger: Fix minor bug in code

2017-09-06 19:16:49 +00:00

ion

ion: Do not 'put' ION handle until after its final use

2023-05-16 12:34:30 +09:00

trace

Revert "android: port fence driver from kernel-4.4 "[1/7]

2017-09-01 21:28:42 +08:00

uapi

ion: add invalid cache function [1/1]

2018-12-29 19:20:49 +08:00

ashmem.c

staging: android: ashmem: Disallow ashmem memory from being remapped

2023-05-15 17:00:08 +09:00

ashmem.h

staging: android: Split uapi out of ashmem.h

2014-02-18 11:03:28 -08:00

Kconfig

Merge branch 'android-4.9' into amlogic-4.9-dev

2018-05-22 10:48:42 +08:00

logger.c

android logger: backport ANDROID_LOGGER driver

2017-03-20 20:10:54 -08:00

logger.h

android logger: backport ANDROID_LOGGER driver

2017-03-20 20:10:54 -08:00

lowmemorykiller.c

mm: revert lmk change [1/1]

2020-12-17 17:19:05 +09:00

Makefile

Merge branch 'android-4.9' into amlogic-4.9-dev

2018-05-22 10:48:42 +08:00

TODO

FROMLIST: staging: vsoc: Create wc kernel mapping for region shm.

2018-05-03 12:28:06 -07:00

vsoc.c

UPSTREAM: staging: android: vsoc: fix copy_from_user overrun

2023-05-16 09:46:37 +09:00