From 1a6a8f34a0b17ac03f42bac416e5d289f9c3248f Mon Sep 17 00:00:00 2001 From: Tom St Denis Date: Fri, 9 Oct 2015 12:07:26 -0400 Subject: [PATCH] amdgpu: Fix use-after-free bug in vamgr_deinit This patch fixes a use-after-free bug in the vamgr_deinit function. Signed-off-by: Tom St Denis Reviewed-by: Alex Deucher --- amdgpu/amdgpu_vamgr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/amdgpu/amdgpu_vamgr.c b/amdgpu/amdgpu_vamgr.c index 2221da03..8a707cbc 100644 --- a/amdgpu/amdgpu_vamgr.c +++ b/amdgpu/amdgpu_vamgr.c @@ -57,8 +57,8 @@ drm_private void amdgpu_vamgr_init(struct amdgpu_bo_va_mgr *mgr, uint64_t start, drm_private void amdgpu_vamgr_deinit(struct amdgpu_bo_va_mgr *mgr) { - struct amdgpu_bo_va_hole *hole; - LIST_FOR_EACH_ENTRY(hole, &mgr->va_holes, list) { + struct amdgpu_bo_va_hole *hole, *tmp; + LIST_FOR_EACH_ENTRY_SAFE(hole, tmp, &mgr->va_holes, list) { list_del(&hole->list); free(hole); }