Commit ae0a1eda authored Jul 14, 2015 by Jordan Crouse Committed by Tarun Karra Jul 15, 2015

msm: kgsl: Zero the pointer to the dmabuf sg list before freeing



We borrow the sg table pointer from the dmabuf if it exists instead
of creating our own.  If it isn't zeroed after calling
kgsl_destroy_ion() then kgsl_sharedmem_free() thinks we own it tries
to walk it / free it.  Since the buffer has been previously freed
bad things happen.

Change-Id: Ic0dedbadbf186a47b8533cc758ff0142744aa8b2
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

parent 3522ea85

drivers/gpu/msm/kgsl.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -2273,8 +2273,10 @@ long kgsl_ioctl_gpuobj_import(struct kgsl_device_private *dev_priv,
		return 0;

		unmap:
		if (param->type == KGSL_USER_MEM_TYPE_DMABUF)
		if (param->type == KGSL_USER_MEM_TYPE_DMABUF) {
		kgsl_destroy_ion(entry->priv_data);
		entry->memdesc.sgt = NULL;
		}

		kgsl_sharedmem_free(&entry->memdesc);