Re: [PATCH] DSPBRIDGE: Fix memory corruption in DRV_ProcFreeDMMRes

[Felipe Contreras <felipe.contreras@nokia.com>]

On Mon, Feb 15, 2010 at 04:36:31PM +0100, Ameya Palande wrote:
> This patch fixes following issues:
> 
> 1. pDMMRes was dereferenced and modified when it was already freed by
> PROC_Ummap(). This results in memory corruption.
> 
> 2.Instead of passing ulDSPAddr, ulDSPResAddr was passed to PROC_UnMap()
> which will not retrieve correct DMMRes element.

You forgot to mention that this patch applies on top of your previous
reserve resource cleanup patches.

> Signed-off-by: Ameya Palande <ameya.palande@nokia.com>

And:
Signed-off-by: Felipe Contreras <felipe.contreras@nokia.com>

> ---
>  drivers/dsp/bridge/rmgr/drv.c |   15 +++++----------
>  1 files changed, 5 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/dsp/bridge/rmgr/drv.c b/drivers/dsp/bridge/rmgr/drv.c
> index 9d5c077..747b34c 100644
> --- a/drivers/dsp/bridge/rmgr/drv.c
> +++ b/drivers/dsp/bridge/rmgr/drv.c
> @@ -273,11 +273,14 @@ DSP_STATUS  DRV_ProcFreeDMMRes(HANDLE hPCtxt)
>  		pDMMList = pDMMList->next;
>  		if (pDMMRes->dmmAllocated) {
>  			status = PROC_UnMap(pDMMRes->hProcessor,
> -				 (void *)pDMMRes->ulDSPResAddr, pCtxt);
> +				 (void *)pDMMRes->ulDSPAddr, pCtxt);
> +			/*
> +			 * PROC_UnMap has freed pDMMRes pointer, so don't access
> +			 * it now
> +			 */

I don't see the need for this comment on the code.

Cheers.

-- 
Felipe Contreras