diff options
| author | Ben Skeggs <bskeggs@redhat.com> | 2017-04-05 18:16:14 +1000 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2017-04-06 14:38:34 +1000 |
| commit | df60d1f23b09c5ce2a8e404012323d4deedcc589 (patch) | |
| tree | 97a05ffa7ac220688988b5261c4f11c448d71307 /drivers/gpu | |
| parent | aeecfcd7440e8ef3b31309fa743cd225090eb8d3 (diff) | |
| download | op-kernel-dev-df60d1f23b09c5ce2a8e404012323d4deedcc589.zip op-kernel-dev-df60d1f23b09c5ce2a8e404012323d4deedcc589.tar.gz | |
drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state
When the atomic support was added to nouveau, the DRM core did not do this.
However, later in the same merge window, a commit (drm/fence: add in-fences
support) was merged that added it, leading to use-after-frees of the fence
object.
Cc: stable@vger.kernel.org [4.10+]
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/nouveau/nv50_display.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c index f4c8c32..c9910c85 100644 --- a/drivers/gpu/drm/nouveau/nv50_display.c +++ b/drivers/gpu/drm/nouveau/nv50_display.c @@ -1002,7 +1002,6 @@ nv50_wndw_atomic_destroy_state(struct drm_plane *plane, { struct nv50_wndw_atom *asyw = nv50_wndw_atom(state); __drm_atomic_helper_plane_destroy_state(&asyw->state); - dma_fence_put(asyw->state.fence); kfree(asyw); } @@ -1014,7 +1013,6 @@ nv50_wndw_atomic_duplicate_state(struct drm_plane *plane) if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL))) return NULL; __drm_atomic_helper_plane_duplicate_state(plane, &asyw->state); - asyw->state.fence = NULL; asyw->interval = 1; asyw->sema = armw->sema; asyw->ntfy = armw->ntfy; |
