From patchwork Wed Feb 17 14:24:57 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ameya Palande X-Patchwork-Id: 79958 X-Patchwork-Delegate: omar.ramirez@ti.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o1HEPoba025846 for ; Wed, 17 Feb 2010 14:25:50 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752378Ab0BQOZs (ORCPT ); Wed, 17 Feb 2010 09:25:48 -0500 Received: from smtp.nokia.com ([192.100.122.233]:54718 "EHLO mgw-mx06.nokia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751585Ab0BQOZs (ORCPT ); Wed, 17 Feb 2010 09:25:48 -0500 Received: from esebh106.NOE.Nokia.com (esebh106.ntc.nokia.com [172.21.138.213]) by mgw-mx06.nokia.com (Switch-3.3.3/Switch-3.3.3) with ESMTP id o1HEPQxp016156; Wed, 17 Feb 2010 16:25:43 +0200 Received: from vaebh104.NOE.Nokia.com ([10.160.244.30]) by esebh106.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 17 Feb 2010 16:25:40 +0200 Received: from mgw-da01.ext.nokia.com ([147.243.128.24]) by vaebh104.NOE.Nokia.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Wed, 17 Feb 2010 16:25:39 +0200 Received: from localhost.localdomain (esdhcp041232.research.nokia.com [172.21.41.232]) by mgw-da01.ext.nokia.com (Switch-3.3.3/Switch-3.3.3) with ESMTP id o1HEPXu0005021; Wed, 17 Feb 2010 16:25:35 +0200 From: Ameya Palande To: linux-omap@vger.kernel.org Cc: felipe.contreras@nokia.com, nm@ti.com, deepak.chitriki@ti.com Subject: [PATCHv2] DSPBRIDGE: Fix memory corruption in DRV_ProcFreeDMMRes Date: Wed, 17 Feb 2010 16:24:57 +0200 Message-Id: <5403b3fb5b4b426d50151571d68f332da03491be.1266416384.git.ameya.palande@nokia.com> X-Mailer: git-send-email 1.6.3.3 X-OriginalArrivalTime: 17 Feb 2010 14:25:40.0383 (UTC) FILETIME=[14B9BAF0:01CAAFDD] X-Nokia-AV: Clean Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Wed, 17 Feb 2010 14:25:50 +0000 (UTC) diff --git a/drivers/dsp/bridge/rmgr/drv.c b/drivers/dsp/bridge/rmgr/drv.c index 12ba7e0..b88b5a3 100644 --- a/drivers/dsp/bridge/rmgr/drv.c +++ b/drivers/dsp/bridge/rmgr/drv.c @@ -293,12 +293,12 @@ DSP_STATUS DRV_ProcFreeDMMRes(HANDLE hPCtxt) pDMMRes = pDMMList; pDMMList = pDMMList->next; if (pDMMRes->dmmAllocated) { + /* PROC_UnMap will free pDMMRes pointer */ status = PROC_UnMap(pDMMRes->hProcessor, - (void *)pDMMRes->ulDSPResAddr, pCtxt); + (void *)pDMMRes->ulDSPAddr, pCtxt); if (DSP_FAILED(status)) pr_debug("%s: PROC_UnMap failed! status =" " 0x%xn", __func__, status); - pDMMRes->dmmAllocated = 0; } } return status; @@ -309,17 +309,9 @@ DSP_STATUS DRV_RemoveAllDMMResElements(HANDLE hPCtxt) { struct PROCESS_CONTEXT *pCtxt = (struct PROCESS_CONTEXT *)hPCtxt; DSP_STATUS status = DSP_SOK; - struct DMM_MAP_OBJECT *pTempDMMRes2 = NULL; - struct DMM_MAP_OBJECT *pTempDMMRes = NULL; struct DMM_RSV_OBJECT *temp, *rsv_obj; DRV_ProcFreeDMMRes(pCtxt); - pTempDMMRes = pCtxt->dmm_map_list; - while (pTempDMMRes != NULL) { - pTempDMMRes2 = pTempDMMRes; - pTempDMMRes = pTempDMMRes->next; - kfree(pTempDMMRes2); - } pCtxt->dmm_map_list = NULL; /* Free DMM reserved memory resources */