diff options
| author | Robert Morell <rmorell@nvidia.com> | 2010-12-06 17:32:01 -0800 |
|---|---|---|
| committer | Dan Willemsen <dwillemsen@nvidia.com> | 2011-11-30 21:36:48 -0800 |
| commit | 2d2f8ec08a08a63cba937132573dcc34abe725c8 (patch) | |
| tree | 97926dc87e412ed566742a86a630142bd71701db /drivers/video/tegra/nvmap/nvmap_handle.c | |
| parent | b1274588c28c91004badef369317db52475be780 (diff) | |
video: tegra: nvmap: Clear handle->owner on release
A struct nvmap_handle may be shared by multiple clients. If the
original client (the handle "owner") is destroyed, but the handle is
still referenced by other clients, h->owner points to freed memory. To
prevent this, clear h->owner when the owner frees its reference to that
struct nvmap_handle.
Change-Id: I54722091568ce2058f5988e5f6e00e68605a8100
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
Diffstat (limited to 'drivers/video/tegra/nvmap/nvmap_handle.c')
| -rw-r--r-- | drivers/video/tegra/nvmap/nvmap_handle.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/video/tegra/nvmap/nvmap_handle.c b/drivers/video/tegra/nvmap/nvmap_handle.c index 4455c8d1cce1..44f55b3f59ba 100644 --- a/drivers/video/tegra/nvmap/nvmap_handle.c +++ b/drivers/video/tegra/nvmap/nvmap_handle.c @@ -379,6 +379,9 @@ void nvmap_free_handle_id(struct nvmap_client *client, unsigned long id) while (pins--) nvmap_unpin_handles(client, &ref->handle, 1); + if (h->owner == client) + h->owner = NULL; + kfree(ref); out: |