| From | John Stultz <> | Subject | [PATCH 097/115] gpu: ion: fix use-after-free in ion_heap_freelist_drain | Date | Fri, 13 Dec 2013 19:26:17 -0800 |
| |
From: Mitchel Humpherys <mitchelh@codeaurora.org>
The `buffer' variable is being used after being freed. Fix this.
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org> Signed-off-by: John Stultz <john.stultz@linaro.org> --- drivers/staging/android/ion/ion_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c index deaab7c..0a5cea0 100644 --- a/drivers/staging/android/ion/ion_heap.c +++ b/drivers/staging/android/ion/ion_heap.c @@ -200,9 +200,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size) if (total_drained >= size) break; list_del(&buffer->list); - ion_buffer_destroy(buffer); heap->free_list_size -= buffer->size; total_drained += buffer->size; + ion_buffer_destroy(buffer); } rt_mutex_unlock(&heap->lock); -- 1.8.3.2
|