diff options
| author | Imre Deak <imre.deak@intel.com> | 2014-12-12 17:57:38 +0200 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2014-12-16 10:38:55 +0100 |
| commit | c8bd0e49519ce1d80196e54ba2e20c3a1b7c88c0 (patch) | |
| tree | 5747a828ea1d69d988e56477c05a54dab16f17fc /drivers/gpu/drm/i915/intel_dp.c | |
| parent | c86ea3d0ad7e60fb92e3d4a0aa4906ec2868a7cd (diff) | |
| download | op-kernel-dev-c8bd0e49519ce1d80196e54ba2e20c3a1b7c88c0.zip op-kernel-dev-c8bd0e49519ce1d80196e54ba2e20c3a1b7c88c0.tar.gz | |
drm/i915: fix use after free during eDP encoder destroying
After
commit a18c0af171bfb875012da26f23df051004726973
uthor: Thierry Reding <treding@nvidia.com>
Date: Wed Dec 10 11:38:49 2014 +0100
drm: Zero out DRM object memory upon cleanup
we will use the eDP encoder during destroying it. Fix this by calling
drm_encoder_cleanup() at a point when the encoder is not used any more.
This caused a NULL pointer dereference in pps_lock(), I can't see that
it caused any other problem.
All the other encoders seem to call drm_encoder_cleanup() at a safe
place.
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'drivers/gpu/drm/i915/intel_dp.c')
| -rw-r--r-- | drivers/gpu/drm/i915/intel_dp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c index 8e276c4..8b31e01 100644 --- a/drivers/gpu/drm/i915/intel_dp.c +++ b/drivers/gpu/drm/i915/intel_dp.c @@ -4310,7 +4310,6 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder) drm_dp_aux_unregister(&intel_dp->aux); intel_dp_mst_encoder_cleanup(intel_dig_port); - drm_encoder_cleanup(encoder); if (is_edp(intel_dp)) { cancel_delayed_work_sync(&intel_dp->panel_vdd_work); /* @@ -4326,6 +4325,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder) intel_dp->edp_notifier.notifier_call = NULL; } } + drm_encoder_cleanup(encoder); kfree(intel_dig_port); } |
