diff options
author | Mitchel Humpherys <mitchelh@codeaurora.org> | 2013-12-13 19:26:17 -0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-12-14 08:57:19 -0800 |
commit | f020b4430bf29a25229fd9975662baefb02facda (patch) | |
tree | 747fc8ec70951e048422fccb0f2bd74a103351fe /drivers/staging/android/ion/ion_heap.c | |
parent | db866e3ded294aac1059d45d6497cf1bdbebaa04 (diff) |
gpu: ion: fix use-after-free in ion_heap_freelist_drain
The `buffer' variable is being used after being freed. Fix this.
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/android/ion/ion_heap.c')
-rw-r--r-- | drivers/staging/android/ion/ion_heap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c index deaab7cd8116..0a5cea0c01e3 100644 --- a/drivers/staging/android/ion/ion_heap.c +++ b/drivers/staging/android/ion/ion_heap.c @@ -200,9 +200,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size) if (total_drained >= size) break; list_del(&buffer->list); - ion_buffer_destroy(buffer); heap->free_list_size -= buffer->size; total_drained += buffer->size; + ion_buffer_destroy(buffer); } rt_mutex_unlock(&heap->lock); |