From patchwork Mon Feb 15 15:36:31 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ameya Palande X-Patchwork-Id: 79423 X-Patchwork-Delegate: omar.ramirez@ti.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o1FFbZlT016700 for ; Mon, 15 Feb 2010 15:37:35 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755797Ab0BOPhb (ORCPT ); Mon, 15 Feb 2010 10:37:31 -0500 Received: from smtp.nokia.com ([192.100.105.134]:29865 "EHLO mgw-mx09.nokia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752613Ab0BOPhb (ORCPT ); Mon, 15 Feb 2010 10:37:31 -0500 Received: from esebh106.NOE.Nokia.com (esebh106.ntc.nokia.com [172.21.138.213]) by mgw-mx09.nokia.com (Switch-3.3.3/Switch-3.3.3) with ESMTP id o1FFbNcd003165; Mon, 15 Feb 2010 09:37:25 -0600 Received: from vaebh104.NOE.Nokia.com ([10.160.244.30]) by esebh106.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 15 Feb 2010 17:37:23 +0200 Received: from mgw-sa01.ext.nokia.com ([147.243.1.47]) by vaebh104.NOE.Nokia.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Mon, 15 Feb 2010 17:37:10 +0200 Received: from localhost.localdomain (esdhcp041231.research.nokia.com [172.21.41.231]) by mgw-sa01.ext.nokia.com (Switch-3.3.3/Switch-3.3.3) with ESMTP id o1FFb80x028619; Mon, 15 Feb 2010 17:37:08 +0200 From: Ameya Palande To: omar.ramirez@ti.com Cc: nm@ti.com, deepak.chitriki@ti.com, linux-omap@vger.kernel.org, felipe.contreras@nokia.com, x0095840@ti.com Subject: [PATCH] DSPBRIDGE: Fix memory corruption in DRV_ProcFreeDMMRes Date: Mon, 15 Feb 2010 17:36:31 +0200 Message-Id: <018f9cad9a346b7a841268f4520a73a98c9cf7c9.1266246072.git.ameya.palande@nokia.com> X-Mailer: git-send-email 1.6.3.3 X-OriginalArrivalTime: 15 Feb 2010 15:37:10.0251 (UTC) FILETIME=[BCDC23B0:01CAAE54] X-Nokia-AV: Clean Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Mon, 15 Feb 2010 15:37:35 +0000 (UTC) diff --git a/drivers/dsp/bridge/rmgr/drv.c b/drivers/dsp/bridge/rmgr/drv.c index 9d5c077..747b34c 100644 --- a/drivers/dsp/bridge/rmgr/drv.c +++ b/drivers/dsp/bridge/rmgr/drv.c @@ -273,11 +273,14 @@ DSP_STATUS DRV_ProcFreeDMMRes(HANDLE hPCtxt) pDMMList = pDMMList->next; if (pDMMRes->dmmAllocated) { status = PROC_UnMap(pDMMRes->hProcessor, - (void *)pDMMRes->ulDSPResAddr, pCtxt); + (void *)pDMMRes->ulDSPAddr, pCtxt); + /* + * PROC_UnMap has freed pDMMRes pointer, so don't access + * it now + */ if (DSP_FAILED(status)) pr_debug("%s: PROC_UnMap failed! status =" " 0x%xn", __func__, status); - pDMMRes->dmmAllocated = 0; } } return status; @@ -288,17 +291,9 @@ DSP_STATUS DRV_RemoveAllDMMResElements(HANDLE hPCtxt) { struct PROCESS_CONTEXT *pCtxt = (struct PROCESS_CONTEXT *)hPCtxt; DSP_STATUS status = DSP_SOK; - struct DMM_MAP_OBJECT *pTempDMMRes2 = NULL; - struct DMM_MAP_OBJECT *pTempDMMRes = NULL; struct DMM_RSV_OBJECT *temp, *rsv_obj; DRV_ProcFreeDMMRes(pCtxt); - pTempDMMRes = pCtxt->dmm_map_list; - while (pTempDMMRes != NULL) { - pTempDMMRes2 = pTempDMMRes; - pTempDMMRes = pTempDMMRes->next; - kfree(pTempDMMRes2); - } pCtxt->dmm_map_list = NULL; /* Free DMM reserved memory resources */