[PATCH] sync: Fix memory corruption in sync_timeline_signal().

2015-03-24 Thread Alistair Strachan
The android_fence_release() function checks for active sync points by calling list_empty() on the list head embedded on the sync point. However, it is only valid to use list_empty() on nodes that have been initialized with INIT_LIST_HEAD() or list_del_init(). Because the list entry has likely

Re: [PATCH] sync: Fix memory corruption in sync_timeline_signal().

2015-03-24 Thread Greg Kroah-Hartman
On Tue, Mar 24, 2015 at 01:55:04PM -0700, Alistair Strachan wrote: > The android_fence_release() function checks for active sync points > by calling list_empty() on the list head embedded on the sync > point. However, it is only valid to use list_empty() on nodes that > have been initialized with

[PATCH] sync: Fix memory corruption in sync_timeline_signal().

2015-03-24 Thread Alistair Strachan
The android_fence_release() function checks for active sync points by calling list_empty() on the list head embedded on the sync point. However, it is only valid to use list_empty() on nodes that have been initialized with INIT_LIST_HEAD() or list_del_init(). Because the list entry has likely

Re: [PATCH] sync: Fix memory corruption in sync_timeline_signal().

2015-03-24 Thread Greg Kroah-Hartman
On Tue, Mar 24, 2015 at 01:55:04PM -0700, Alistair Strachan wrote: The android_fence_release() function checks for active sync points by calling list_empty() on the list head embedded on the sync point. However, it is only valid to use list_empty() on nodes that have been initialized with

[PATCH] sync: Fix memory corruption in sync_timeline_signal().

2015-03-24 Thread Alistair Strachan
The android_fence_release() function checks for active sync points by calling list_empty() on the list head embedded on the sync point. However, it is only valid to use list_empty() on nodes that have been initialized with INIT_LIST_HEAD() or list_del_init(). Because the list entry has likely

[PATCH] sync: Fix memory corruption in sync_timeline_signal().

2015-03-24 Thread Alistair Strachan
The android_fence_release() function checks for active sync points by calling list_empty() on the list head embedded on the sync point. However, it is only valid to use list_empty() on nodes that have been initialized with INIT_LIST_HEAD() or list_del_init(). Because the list entry has likely