Commit f020b443 authored Dec 13, 2013 by Mitchel Humpherys Committed by Greg Kroah-Hartman Dec 14, 2013

gpu: ion: fix use-after-free in ion_heap_freelist_drain



The `buffer' variable is being used after being freed. Fix this.

Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent db866e3d

drivers/staging/android/ion/ion_heap.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -200,9 +200,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size)
		if (total_drained >= size)
		break;
		list_del(&buffer->list);
		ion_buffer_destroy(buffer);
		heap->free_list_size -= buffer->size;
		total_drained += buffer->size;
		ion_buffer_destroy(buffer);
		}
		rt_mutex_unlock(&heap->lock);