diff options
author | Alex Waterman <alexw@nvidia.com> | 2015-06-10 13:25:10 -0400 |
---|---|---|
committer | Terje Bergstrom <tbergstrom@nvidia.com> | 2015-06-11 13:17:13 -0400 |
commit | 0035aff30712a4506a028345b171eb616572bddb (patch) | |
tree | 2c328d36b6092a51939490ab55d1ce9e36b9fc1a /drivers/gpu | |
parent | 099af7667486b3b21c42bd5ed8543e70cabc6f92 (diff) |
gpu: nvgpu: Swap order of free/rb_erase
If rb_erase() is called after __balloc_do_free_fixed() then the
rb_tree code crashes when trying to dereference the possibly changed
(or poisoned in the case of debugging) data in the rb_node.
Change-Id: I4a4456a5ec453fd9ab117c804dc19b2c048a61d4
Signed-off-by: Alex Waterman <alexw@nvidia.com>
Reviewed-on: http://git-master/r/755646
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-by: Ian Stewart <istewart@nvidia.com>
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/755816
Tested-by: Terje Bergstrom <tbergstrom@nvidia.com>
Diffstat (limited to 'drivers/gpu')
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/gk20a_allocator.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c b/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c index badfcd9f..b6549cee 100644 --- a/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c +++ b/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c | |||
@@ -357,8 +357,8 @@ void gk20a_allocator_destroy(struct gk20a_allocator *a) | |||
357 | falloc = container_of(node, | 357 | falloc = container_of(node, |
358 | struct gk20a_fixed_alloc, alloced_entry); | 358 | struct gk20a_fixed_alloc, alloced_entry); |
359 | 359 | ||
360 | __balloc_do_free_fixed(a, falloc); | ||
361 | rb_erase(node, &a->fixed_allocs); | 360 | rb_erase(node, &a->fixed_allocs); |
361 | __balloc_do_free_fixed(a, falloc); | ||
362 | } | 362 | } |
363 | 363 | ||
364 | /* | 364 | /* |