From f020b4430bf29a25229fd9975662baefb02facda Mon Sep 17 00:00:00 2001 From: Mitchel Humpherys Date: Fri, 13 Dec 2013 19:26:17 -0800 Subject: [PATCH] gpu: ion: fix use-after-free in ion_heap_freelist_drain The `buffer' variable is being used after being freed. Fix this. Signed-off-by: Mitchel Humpherys Signed-off-by: John Stultz Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c index deaab7cd8116..0a5cea0c01e3 100644 --- a/drivers/staging/android/ion/ion_heap.c +++ b/drivers/staging/android/ion/ion_heap.c @@ -200,9 +200,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size) if (total_drained >= size) break; list_del(&buffer->list); - ion_buffer_destroy(buffer); heap->free_list_size -= buffer->size; total_drained += buffer->size; + ion_buffer_destroy(buffer); } rt_mutex_unlock(&heap->lock); -- 2.34.1