| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 13 Dec 2013 19:26:17 -0800 From: John Stultz <john.stultz@...aro.org> To: LKML <linux-kernel@...r.kernel.org> Cc: Greg KH <gregkh@...uxfoundation.org>, Android Kernel Team <kernel-team@...roid.com>, Sumit Semwal <sumit.semwal@...aro.org>, Jesse Barker <jesse.barker@....com>, Colin Cross <ccross@...roid.com>, Mitchel Humpherys <mitchelh@...eaurora.org>, John Stultz <john.stultz@...aro.org> Subject: [PATCH 097/115] gpu: ion: fix use-after-free in ion_heap_freelist_drain From: Mitchel Humpherys <mitchelh@...eaurora.org> The `buffer' variable is being used after being freed. Fix this. Signed-off-by: Mitchel Humpherys <mitchelh@...eaurora.org> Signed-off-by: John Stultz <john.stultz@...aro.org> --- drivers/staging/android/ion/ion_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c index deaab7c..0a5cea0 100644 --- a/drivers/staging/android/ion/ion_heap.c +++ b/drivers/staging/android/ion/ion_heap.c @@ -200,9 +200,9 @@ size_t ion_heap_freelist_drain(struct ion_heap *heap, size_t size) if (total_drained >= size) break; list_del(&buffer->list); - ion_buffer_destroy(buffer); heap->free_list_size -= buffer->size; total_drained += buffer->size; + ion_buffer_destroy(buffer); } rt_mutex_unlock(&heap->lock); -- 1.8.3.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists