]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e0bb16d) | patch
drm: use after free in drm_queue_vblank_event()
authorDan Carpenter <error27@gmail.com>
Thu, 9 Dec 2010 05:35:40 +0000 (08:35 +0300)
committerDave Airlie <airlied@redhat.com>
Thu, 9 Dec 2010 07:27:25 +0000 (17:27 +1000)
commitea6c327b4ac52667ca6e7d2cddb605731e5e118f
treeb85fe0a40e12e00b6c7881b14ef5fabbc45f7acdtree | snapshot
parente0bb16dd5fbdae7e18ae5191937587bde9c7db9bcommit | diff
drm: use after free in drm_queue_vblank_event()

The "e" pointer is either NULL or freed when we call
drm_vblank_put(dev, e->pipe) on the error path.  Just pass the "pipe"
variable directly instead.

I changed another caller to use "pipe" as well for consistency.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/drm_irq.c diff | blob | history
Linux Kernel Source Tree.