aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMitchel Humpherys <mitchelh@codeaurora.org>2013-08-06 11:19:42 -0700
committerColin Cross <ccross@android.com>2013-12-12 15:27:06 -0800
commit9273153e861f3db897798ec0dc15f70d1aae9410 (patch)
treef3e92dc612b228e4819623e9914432f58d39802d
parentb2ee33eb98bd8240787f6b3a6acffdbab40653dc (diff)
gpu: ion: fix use-after-free in ion_heap_freelist_drain
The `buffer' variable is being used after being freed. Fix this. Change-Id: Iea3471fa7dc7535bbf0620c1639fea2008d7cf19 Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
-rw-r--r--drivers/staging/android/ion/ion_heap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
index 5a93a0273fa..e061b266330 100644
--- a/drivers/staging/android/ion/ion_heap.c
+++ b/drivers/staging/android/ion/ion_heap.c
@@ -200,9 +200,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size)
if (total_drained >= size)
break;
list_del(&buffer->list);
- ion_buffer_destroy(buffer);
heap->free_list_size -= buffer->size;
total_drained += buffer->size;
+ ion_buffer_destroy(buffer);
}
rt_mutex_unlock(&heap->lock);