ion: invalidate the pool pointers after free
ion_system_heap_destroy_pools frees the pool, but
does not invalidate the pointer. This can result in
a double free if ion_system_heap_create_pools fails,
and then causes ion_system_heap_create to call into
ion_system_heap_destroy_pools again from the error
path. This can happen in ion_system_heap_create when
one of the secure pool creation fails.
Change-Id: Ic73ca78722aa5a575cc4dd7c1caa560b518094f2
Signed-off-by:
Vinayak Menon <vinmenon@codeaurora.org>
Loading
Please register or sign in to comment