@@ -215,25 +215,28 @@ ur_result_t SanitizerInterceptor::releaseMemory(ur_context_handle_t Context,
215215 if (ReleaseList.size ()) {
216216 std::scoped_lock<ur_shared_mutex> Guard (m_AllocationMapMutex);
217217 for (auto &It : ReleaseList) {
218+ auto ToFreeAllocInfo = It->second ;
218219 getContext ()->logger .info (" Quarantine Free: {}" ,
219- (void *)It-> second ->AllocBegin );
220+ (void *)ToFreeAllocInfo ->AllocBegin );
220221
221- ContextInfo->Stats .UpdateUSMRealFreed (AllocInfo-> AllocSize ,
222- AllocInfo ->getRedzoneSize ());
222+ ContextInfo->Stats .UpdateUSMRealFreed (
223+ ToFreeAllocInfo-> AllocSize , ToFreeAllocInfo ->getRedzoneSize ());
223224
224- m_AllocationMap.erase (It);
225- if (AllocInfo->Type == AllocType::HOST_USM) {
225+ if (ToFreeAllocInfo->Type == AllocType::HOST_USM) {
226226 for (auto &Device : ContextInfo->DeviceList ) {
227227 UR_CALL (getDeviceInfo (Device)->Shadow ->ReleaseShadow (
228- AllocInfo ));
228+ ToFreeAllocInfo ));
229229 }
230230 } else {
231- UR_CALL (getDeviceInfo (AllocInfo ->Device )
232- ->Shadow ->ReleaseShadow (AllocInfo ));
231+ UR_CALL (getDeviceInfo (ToFreeAllocInfo ->Device )
232+ ->Shadow ->ReleaseShadow (ToFreeAllocInfo ));
233233 }
234234
235235 UR_CALL (getContext ()->urDdiTable .USM .pfnFree (
236- Context, (void *)(It->second ->AllocBegin )));
236+ Context, (void *)(ToFreeAllocInfo->AllocBegin )));
237+
238+ // Erase it at last to avoid use-after-free.
239+ m_AllocationMap.erase (It);
237240 }
238241 }
239242 ContextInfo->Stats .UpdateUSMFreed (AllocInfo->AllocSize );
0 commit comments