* [patch 2/2] drm/i915: use after free on error path
@ 2013-07-19 5:46 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2013-07-19 5:46 UTC (permalink / raw)
To: Daniel Vetter; +Cc: David Airlie, intel-gfx, dri-devel, kernel-janitors
i915_gem_vma_destroy() frees its argument so we have to move the
drm_mm_remove_node() call up a few lines.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 9a9a77a..f347ad5 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3161,9 +3161,9 @@ search_free:
return 0;
err_out:
+ drm_mm_remove_node(&vma->node);
i915_gem_vma_destroy(vma);
i915_gem_object_unpin_pages(obj);
- drm_mm_remove_node(&vma->node);
return ret;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch 2/2] drm/i915: use after free on error path
@ 2013-07-19 5:46 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2013-07-19 5:46 UTC (permalink / raw)
To: Daniel Vetter; +Cc: David Airlie, intel-gfx, dri-devel, kernel-janitors
i915_gem_vma_destroy() frees its argument so we have to move the
drm_mm_remove_node() call up a few lines.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 9a9a77a..f347ad5 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3161,9 +3161,9 @@ search_free:
return 0;
err_out:
+ drm_mm_remove_node(&vma->node);
i915_gem_vma_destroy(vma);
i915_gem_object_unpin_pages(obj);
- drm_mm_remove_node(&vma->node);
return ret;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch 2/2] drm/i915: use after free on error path
2013-07-19 5:46 ` Dan Carpenter
@ 2013-07-19 7:01 ` Daniel Vetter
-1 siblings, 0 replies; 4+ messages in thread
From: Daniel Vetter @ 2013-07-19 7:01 UTC (permalink / raw)
To: Dan Carpenter
Cc: Daniel Vetter, David Airlie, intel-gfx, dri-devel, kernel-janitors
On Fri, Jul 19, 2013 at 08:46:27AM +0300, Dan Carpenter wrote:
> i915_gem_vma_destroy() frees its argument so we have to move the
> drm_mm_remove_node() call up a few lines.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Both applied, thanks for the patches.
-Daniel
>
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index 9a9a77a..f347ad5 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -3161,9 +3161,9 @@ search_free:
> return 0;
>
> err_out:
> + drm_mm_remove_node(&vma->node);
> i915_gem_vma_destroy(vma);
> i915_gem_object_unpin_pages(obj);
> - drm_mm_remove_node(&vma->node);
> return ret;
> }
>
--
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch 2/2] drm/i915: use after free on error path
@ 2013-07-19 7:01 ` Daniel Vetter
0 siblings, 0 replies; 4+ messages in thread
From: Daniel Vetter @ 2013-07-19 7:01 UTC (permalink / raw)
To: Dan Carpenter
Cc: Daniel Vetter, David Airlie, intel-gfx, dri-devel, kernel-janitors
On Fri, Jul 19, 2013 at 08:46:27AM +0300, Dan Carpenter wrote:
> i915_gem_vma_destroy() frees its argument so we have to move the
> drm_mm_remove_node() call up a few lines.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Both applied, thanks for the patches.
-Daniel
>
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index 9a9a77a..f347ad5 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -3161,9 +3161,9 @@ search_free:
> return 0;
>
> err_out:
> + drm_mm_remove_node(&vma->node);
> i915_gem_vma_destroy(vma);
> i915_gem_object_unpin_pages(obj);
> - drm_mm_remove_node(&vma->node);
> return ret;
> }
>
--
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-07-19 7:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-07-19 5:46 [patch 2/2] drm/i915: use after free on error path Dan Carpenter
2013-07-19 5:46 ` Dan Carpenter
2013-07-19 7:01 ` Daniel Vetter
2013-07-19 7:01 ` Daniel Vetter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.