Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit faa3e614 authored by Vijayanand Jitta's avatar Vijayanand Jitta Committed by Gerrit - the friendly Code Review server
Browse files

dma-buf: Remove dmabuf from db_list before releasing 



commit "d8f41e97 ion: add additional debug info in dmabuf exp_info"
makes exp_name allocation dynamic and this could get freed while buffer
is still in release path, since ops->release is called before removing
the dmabuf from db_list.Calling dma_buf_debug_show at this point would
try accessing already freed exp_name as db_list still contains the dmabuf.
Fix it by removing the dmabuf from db_list and then invoke ops->release.

Change-Id: Ia3266cfee5b9cd7fe9716198730450b9c8d00b3c
Signed-off-by: default avatarVijayanand Jitta <vjitta@codeaurora.org>
parent 0d2cc45e

drivers/dma-buf/dma-buf.c

+2 −2
Original line number Diff line number Diff line
@@ -87,12 +87,12 @@ static int dma_buf_release(struct inode *inode, struct file *file) 
	 */

	BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);



	dmabuf->ops->release(dmabuf);



	mutex_lock(&db_list.lock);

	list_del(&dmabuf->list_node);

	mutex_unlock(&db_list.lock);



	dmabuf->ops->release(dmabuf);



	dma_buf_ref_destroy(dmabuf);



	if (dmabuf->resv == (struct reservation_object *)&dmabuf[1])