diff options
author | Robert Morell <rmorell@nvidia.com> | 2010-12-06 17:32:01 -0800 |
---|---|---|
committer | Rebecca Schultz Zavin <rebecca@android.com> | 2010-12-06 19:26:21 -0800 |
commit | 0e3fe9b3944d3dad3b2268d4acdbd77fd727dcd5 (patch) | |
tree | 3e724d2da766974527f73b6f1e92501451bc11e7 | |
parent | c0132a6dfe0a4f30ae27fe119b40e0a39bc0ceb7 (diff) |
video: tegra: nvmap: Clear handle->owner on release
A struct nvmap_handle may be shared by multiple clients. If the
original client (the handle "owner") is destroyed, but the handle is
still referenced by other clients, h->owner points to freed memory. To
prevent this, clear h->owner when the owner frees its reference to that
struct nvmap_handle.
Change-Id: I54722091568ce2058f5988e5f6e00e68605a8100
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
-rw-r--r-- | drivers/video/tegra/nvmap/nvmap_handle.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/video/tegra/nvmap/nvmap_handle.c b/drivers/video/tegra/nvmap/nvmap_handle.c index 4455c8d1cce1..44f55b3f59ba 100644 --- a/drivers/video/tegra/nvmap/nvmap_handle.c +++ b/drivers/video/tegra/nvmap/nvmap_handle.c @@ -379,6 +379,9 @@ void nvmap_free_handle_id(struct nvmap_client *client, unsigned long id) while (pins--) nvmap_unpin_handles(client, &ref->handle, 1); + if (h->owner == client) + h->owner = NULL; + kfree(ref); out: |