]> git.baikalelectronics.ru Git - kernel.git/commit
drm/core: Fix ordering in drm_mode_config_cleanup.
authorMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
Tue, 22 Mar 2016 14:42:14 +0000 (15:42 +0100)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Tue, 12 Apr 2016 10:43:26 +0000 (12:43 +0200)
commitb5969a8984346328ebda76ae255118ce49ab8be2
tree3ff0a380d6e96b1d0b9835c0b7ad2ea47250d777
parente1418ca122d2c4229634116c483c65198f0053a3
drm/core: Fix ordering in drm_mode_config_cleanup.

__drm_atomic_helper_plane_destroy_state calls
drm_framebuffer_unreference, which means that if drm_framebuffer_free
is called before plane->destroy freed memory will be accessed.

A similar case happens for the blob list, which was freed before the
crtc state was, resulting in the unreference_blob from crtc_destroy_state
pointing to garbage memory causing another opportunity for a GPF.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1458657734-21866-1-git-send-email-maarten.lankhorst@linux.intel.com
drivers/gpu/drm/drm_crtc.c