Commit 03991033 authored by Tomi Valkeinen's avatar Tomi Valkeinen Committed by Anand Balagopalakrishnan
Browse files

km: fix use of freed gem object in UnwrapExtMemoryCallBack()



UnwrapExtMemoryCallBack() first frees the drm_gem_object via
FreeMemCallBackCommon(), and then continues using the drm_gem_object by
calling omap_gem_put_paddr(). This leads to omap_gem_put_paddr()
accessing freed memory.

Change the call order to first call omap_gem_put_paddr() and only then
call FreeMemCallBackCommon().
Signed-off-by: default avatarTomi Valkeinen <tomi.valkeinen@ti.com>
parent 5f12c9fe
......@@ -1628,15 +1628,8 @@ static PVRSRV_ERROR UnwrapExtMemoryCallBack(IMG_PVOID pvParam,
PVRSRV_KERNEL_MEM_INFO *psMemInfo = (PVRSRV_KERNEL_MEM_INFO *)pvParam;
#if defined(SUPPORT_DRI_DRM_EXTERNAL)
IMG_BOOL bPhysContig = (IMG_BOOL)ui32Param;
struct drm_gem_object *buf =
BM_GetGEM(psMemInfo->sMemBlk.hBuffer);
#endif
PVRSRV_ERROR err = FreeMemCallBackCommon(psMemInfo, ui32Param,
PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR);
PVR_UNREFERENCED_PARAMETER(bDummy);
struct drm_gem_object *buf = BM_GetGEM(psMemInfo->sMemBlk.hBuffer);
#if defined(SUPPORT_DRI_DRM_EXTERNAL)
if (buf) {
if (omap_gem_flags(buf) & OMAP_BO_TILED_MASK) {
omap_gem_put_paddr(buf);
......@@ -1650,7 +1643,10 @@ static PVRSRV_ERROR UnwrapExtMemoryCallBack(IMG_PVOID pvParam,
}
#endif /* SUPPORT_DRI_DRM_EXTERNAL */
return err;
PVR_UNREFERENCED_PARAMETER(bDummy);
return FreeMemCallBackCommon(psMemInfo, ui32Param,
PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR);
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment