The reference count of obj will be decremented twice if error occurs
in dma_buf_fd(). Additionally, attempting to read the reference count of
obj after dropping reference may lead to a use after free bug. Here, we
drop obj's reference until it is not used.
Fixes:
|
||
---|---|---|
.. | ||
drm | ||
host1x | ||
ipu-v3 | ||
vga | ||
Makefile |