diff mbox

[2/3] amdgpu: Fix use-after-free bug in vamgr_deinit

Message ID 1445532023-16778-2-git-send-email-alexander.deucher@amd.com (mailing list archive)
State New, archived
Headers show

Commit Message

Alex Deucher Oct. 22, 2015, 4:40 p.m. UTC 
From: Tom St Denis <tom.stdenis@amd.com>

This patch fixes a use-after-free bug in the vamgr_deinit function.

Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
---
 amdgpu/amdgpu_vamgr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/amdgpu/amdgpu_vamgr.c b/amdgpu/amdgpu_vamgr.c
index 2221da0..8a707cb 100644
--- a/amdgpu/amdgpu_vamgr.c
+++ b/amdgpu/amdgpu_vamgr.c
@@ -57,8 +57,8 @@  drm_private void amdgpu_vamgr_init(struct amdgpu_bo_va_mgr *mgr, uint64_t start,
 
 drm_private void amdgpu_vamgr_deinit(struct amdgpu_bo_va_mgr *mgr)
 {
-	struct amdgpu_bo_va_hole *hole;
-	LIST_FOR_EACH_ENTRY(hole, &mgr->va_holes, list) {
+	struct amdgpu_bo_va_hole *hole, *tmp;
+	LIST_FOR_EACH_ENTRY_SAFE(hole, tmp, &mgr->va_holes, list) {
 		list_del(&hole->list);
 		free(hole);
 	}