summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTomi Valkeinen <tomi.valkeinen@ti.com>2015-12-04 16:12:04 +0300
committerEric Ruei <e-ruei1@ti.com>2015-12-04 16:44:41 +0300
commitf7ae3f68dd6a05f67b15702b823ed15d2c03105d (patch)
tree0d96702c07ce15c7c7f775c023e841ad1c1c5397
parent85196abde383f0a032de3159981044753d8e64aa (diff)
downloadomap5-sgx-ddk-linux-am4/k4.1.tar.xz
km: fix use of freed gem object in UnwrapExtMemoryCallBack()am4/k4.1
UnwrapExtMemoryCallBack() first frees the drm_gem_object via FreeMemCallBackCommon(), and then continues using the drm_gem_object by calling omap_gem_put_paddr(). This leads to omap_gem_put_paddr() accessing freed memory. Change the call order to first call omap_gem_put_paddr() and only then call FreeMemCallBackCommon(). Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
-rw-r--r--[-rwxr-xr-x]eurasia_km/services4/srvkm/common/devicemem.c14
1 files changed, 5 insertions, 9 deletions
diff --git a/eurasia_km/services4/srvkm/common/devicemem.c b/eurasia_km/services4/srvkm/common/devicemem.c
index a0aee0d..98e1844 100755..100644
--- a/eurasia_km/services4/srvkm/common/devicemem.c
+++ b/eurasia_km/services4/srvkm/common/devicemem.c
@@ -1627,15 +1627,8 @@ static PVRSRV_ERROR UnwrapExtMemoryCallBack(IMG_PVOID pvParam,
PVRSRV_KERNEL_MEM_INFO *psMemInfo = (PVRSRV_KERNEL_MEM_INFO *)pvParam;
#if defined(SUPPORT_DRI_DRM_EXTERNAL)
IMG_BOOL bPhysContig = (IMG_BOOL)ui32Param;
- struct drm_gem_object *buf =
- BM_GetGEM(psMemInfo->sMemBlk.hBuffer);
-#endif
- PVRSRV_ERROR err = FreeMemCallBackCommon(psMemInfo, ui32Param,
- PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR);
-
- PVR_UNREFERENCED_PARAMETER(bDummy);
+ struct drm_gem_object *buf = BM_GetGEM(psMemInfo->sMemBlk.hBuffer);
-#if defined(SUPPORT_DRI_DRM_EXTERNAL)
if (buf) {
if (omap_gem_flags(buf) & OMAP_BO_TILED_MASK) {
omap_gem_put_paddr(buf);
@@ -1649,7 +1642,10 @@ static PVRSRV_ERROR UnwrapExtMemoryCallBack(IMG_PVOID pvParam,
}
#endif /* SUPPORT_DRI_DRM_EXTERNAL */
- return err;
+ PVR_UNREFERENCED_PARAMETER(bDummy);
+
+ return FreeMemCallBackCommon(psMemInfo, ui32Param,
+ PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR);
}