diff options
author | Mitchel Humpherys <mitchelh@codeaurora.org> | 2013-08-06 11:19:42 -0700 |
---|---|---|
committer | Colin Cross <ccross@android.com> | 2013-12-12 15:27:06 -0800 |
commit | 9273153e861f3db897798ec0dc15f70d1aae9410 (patch) | |
tree | f3e92dc612b228e4819623e9914432f58d39802d /drivers/staging/android/ion | |
parent | b2ee33eb98bd8240787f6b3a6acffdbab40653dc (diff) |
gpu: ion: fix use-after-free in ion_heap_freelist_drain
The `buffer' variable is being used after being freed. Fix this.
Change-Id: Iea3471fa7dc7535bbf0620c1639fea2008d7cf19
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Diffstat (limited to 'drivers/staging/android/ion')
-rw-r--r-- | drivers/staging/android/ion/ion_heap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c index 5a93a0273fa..e061b266330 100644 --- a/drivers/staging/android/ion/ion_heap.c +++ b/drivers/staging/android/ion/ion_heap.c @@ -200,9 +200,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size) if (total_drained >= size) break; list_del(&buffer->list); - ion_buffer_destroy(buffer); heap->free_list_size -= buffer->size; total_drained += buffer->size; + ion_buffer_destroy(buffer); } rt_mutex_unlock(&heap->lock); |