Re: [PATCH] DSPBRIDGE: Fix memory corruption in DRV_ProcFreeDMMRes

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Feb 15, 2010 at 04:36:31PM +0100, Ameya Palande wrote:
> This patch fixes following issues:
> 
> 1. pDMMRes was dereferenced and modified when it was already freed by
> PROC_Ummap(). This results in memory corruption.
> 
> 2.Instead of passing ulDSPAddr, ulDSPResAddr was passed to PROC_UnMap()
> which will not retrieve correct DMMRes element.

You forgot to mention that this patch applies on top of your previous
reserve resource cleanup patches.

> Signed-off-by: Ameya Palande <ameya.palande@xxxxxxxxx>

And:
Signed-off-by: Felipe Contreras <felipe.contreras@xxxxxxxxx>

> ---
>  drivers/dsp/bridge/rmgr/drv.c |   15 +++++----------
>  1 files changed, 5 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/dsp/bridge/rmgr/drv.c b/drivers/dsp/bridge/rmgr/drv.c
> index 9d5c077..747b34c 100644
> --- a/drivers/dsp/bridge/rmgr/drv.c
> +++ b/drivers/dsp/bridge/rmgr/drv.c
> @@ -273,11 +273,14 @@ DSP_STATUS  DRV_ProcFreeDMMRes(HANDLE hPCtxt)
>  		pDMMList = pDMMList->next;
>  		if (pDMMRes->dmmAllocated) {
>  			status = PROC_UnMap(pDMMRes->hProcessor,
> -				 (void *)pDMMRes->ulDSPResAddr, pCtxt);
> +				 (void *)pDMMRes->ulDSPAddr, pCtxt);
> +			/*
> +			 * PROC_UnMap has freed pDMMRes pointer, so don't access
> +			 * it now
> +			 */

I don't see the need for this comment on the code.

Cheers.

-- 
Felipe Contreras
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Arm (vger)]     [ARM Kernel]     [ARM MSM]     [Linux Tegra]     [Linux WPAN Networking]     [Linux Wireless Networking]     [Maemo Users]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Trails]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux