video-driver: fix invalid ptr dereference with destroy_buffers

read_only and release list does not take dma ref_count
using dma_buf_get(). dma_buf ptr will be obselete when
its ref_count reaches zero. So print the dma_buf info
before releasing the ref count.

Change-Id: I8c145a1107b83c7f3b366834feb37171c8614d15
Signed-off-by: Priyanka Gujjula <[email protected]>
Signed-off-by: Govindaraj Rajagopal <[email protected]>

driver/vidc/src/msm_vidc_driver.c

@@ -5092,6 +5092,22 @@ void msm_vidc_destroy_buffers(struct msm_vidc_inst *inst)
 		}
 	}
 
+	/* read_only and release list does not take dma ref_count using dma_buf_get().
+	   dma_buf ptr will be obselete when its ref_count reaches zero. Hence print
+	   the dma_buf info before releasing the ref count.
+	*/
+	list_for_each_entry_safe(buf, dummy, &inst->buffers.read_only.list, list) {
+		print_vidc_buffer(VIDC_ERR, "err ", "destroying ro buffer", inst, buf);
+		list_del(&buf->list);
+		msm_memory_free(inst, buf);
+	}
+
+	list_for_each_entry_safe(buf, dummy, &inst->buffers.release.list, list) {
+		print_vidc_buffer(VIDC_ERR, "err ", "destroying release buffer", inst, buf);
+		list_del(&buf->list);
+		msm_memory_free(inst, buf);
+	}
+
 	for (i = 0; i < ARRAY_SIZE(ext_buf_types); i++) {
 		buffers = msm_vidc_get_buffers(inst, ext_buf_types[i], __func__);
 		if (!buffers)
@@ -5106,18 +5122,6 @@ void msm_vidc_destroy_buffers(struct msm_vidc_inst *inst)
 		msm_vidc_unmap_buffers(inst, ext_buf_types[i]);
 	}
 
-	list_for_each_entry_safe(buf, dummy, &inst->buffers.read_only.list, list) {
-		print_vidc_buffer(VIDC_ERR, "err ", "destroying ro buffer", inst, buf);
-		list_del(&buf->list);
-		msm_memory_free(inst, buf);
-	}
-
-	list_for_each_entry_safe(buf, dummy, &inst->buffers.release.list, list) {
-		print_vidc_buffer(VIDC_ERR, "err ", "destroying release buffer", inst, buf);
-		list_del(&buf->list);
-		msm_memory_free(inst, buf);
-	}
-
 	list_for_each_entry_safe(ts, dummy_ts, &inst->timestamps.list, sort.list) {
 		i_vpr_e(inst, "%s: removing ts: val %lld, rank %lld\n",
 			__func__, ts->sort.val, ts->rank);