diff options
author | Alistair Strachan <alistair.strachan@imgtec.com> | 2014-04-21 13:09:23 -0700 |
---|---|---|
committer | Greg Hackmann <ghackmann@google.com> | 2014-04-23 16:36:53 +0000 |
commit | c1bceaea3e32167babd4c89c7085f4c2f6ad473f (patch) | |
tree | 0d5284c32e4dc29d64ff0d1146b92f8111763f44 /fs | |
parent | e8430cbed3ef15fdb1ac26cfd020e010aa5f1c35 (diff) |
video: adf: use rb_erase in adf_obj_destroy.
Not calling rb_erase() can cause slab corruption, as the rb_first() call
after kfree() in adf_obj_destroy() can return the same node twice unless
it is erased.
This problem was reproduced by unloading a kernel module that used the
adf framework *after* a vsync event was registered. A crash would occur
in rb_first(). (Just loading and immediately unloading the module without
the vsync event worked correctly.)
Change-Id: I9fa7cb5d7519691e38a281439844aa193da13d1b
Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com>
Cc: Jonathan Hamilton <jonathan.hamilton@imgtec.com>
Cc: Greg Hackmann <ghackmann@google.com>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions