video: adf: use rb_erase in adf_obj_destroy.
Not calling rb_erase() can cause slab corruption, as the rb_first() call after kfree() in adf_obj_destroy() can return the same node twice unless it is erased. This problem was reproduced by unloading a kernel module that used the adf framework *after* a vsync event was registered. A crash would occur in rb_first(). (Just loading and immediately unloading the module without the vsync event worked correctly.) Change-Id: I9fa7cb5d7519691e38a281439844aa193da13d1b Signed-off-by:Alistair Strachan <alistair.strachan@imgtec.com> Cc: Jonathan Hamilton <jonathan.hamilton@imgtec.com> Cc: Greg Hackmann <ghackmann@google.com> Git-commit: c1bceaea3e32167babd4c89c7085f4c2f6ad473f Git-repo: https://android.googlesource.com/kernel/common.git Signed-off-by:
Ian Maund <imaund@codeaurora.org>
Loading
Please register or sign in to comment