gpu: nvgpu: Swap order of free/rb_erase

If rb_erase() is called after __balloc_do_free_fixed() then the
rb_tree code crashes when trying to dereference the possibly changed
(or poisoned in the case of debugging) data in the rb_node.

Change-Id: I4a4456a5ec453fd9ab117c804dc19b2c048a61d4
Signed-off-by: Alex Waterman <alexw@nvidia.com>
Reviewed-on: http://git-master/r/755646
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-by: Ian Stewart <istewart@nvidia.com>
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/755816
Tested-by: Terje Bergstrom <tbergstrom@nvidia.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c b/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c
index badfcd9f..b6549cee 100644
--- a/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c
+++ b/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c
@@ -357,8 +357,8 @@ void gk20a_allocator_destroy(struct gk20a_allocator *a)
                 falloc = container_of(node,
                                       struct gk20a_fixed_alloc, alloced_entry);
 
-                __balloc_do_free_fixed(a, falloc);
                 rb_erase(node, &a->fixed_allocs);
+                __balloc_do_free_fixed(a, falloc);
         }
 
         /*