From 0035aff30712a4506a028345b171eb616572bddb Mon Sep 17 00:00:00 2001 From: Alex Waterman Date: Wed, 10 Jun 2015 10:25:10 -0700 Subject: gpu: nvgpu: Swap order of free/rb_erase If rb_erase() is called after __balloc_do_free_fixed() then the rb_tree code crashes when trying to dereference the possibly changed (or poisoned in the case of debugging) data in the rb_node. Change-Id: I4a4456a5ec453fd9ab117c804dc19b2c048a61d4 Signed-off-by: Alex Waterman Reviewed-on: http://git-master/r/755646 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Krishna Reddy Reviewed-by: Ian Stewart Reviewed-by: Terje Bergstrom Reviewed-on: http://git-master/r/755816 Tested-by: Terje Bergstrom --- drivers/gpu/nvgpu/gk20a/gk20a_allocator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/gpu/nvgpu/gk20a/gk20a_allocator.c') diff --git a/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c b/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c index badfcd9f..b6549cee 100644 --- a/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c +++ b/drivers/gpu/nvgpu/gk20a/gk20a_allocator.c @@ -357,8 +357,8 @@ void gk20a_allocator_destroy(struct gk20a_allocator *a) falloc = container_of(node, struct gk20a_fixed_alloc, alloced_entry); - __balloc_do_free_fixed(a, falloc); rb_erase(node, &a->fixed_allocs); + __balloc_do_free_fixed(a, falloc); } /* -- cgit v1.2.2