gpu: ion: fix use-after-free in ion_heap_freelist_drain



The `buffer' variable is being used after being freed. Fix this.

Change-Id: Iea3471fa7dc7535bbf0620c1639fea2008d7cf19
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>

parent 58aacff2

drivers/gpu/ion/ion_heap.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -184,9 +184,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size)
		if (total_drained >= size)
		break;
		list_del(&buffer->list);
		ion_buffer_destroy(buffer);
		heap->free_list_size -= buffer->size;
		total_drained += buffer->size;
		ion_buffer_destroy(buffer);
		}
		rt_mutex_unlock(&heap->lock);