Commit 1646605d authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Luis Henriques

drm/i915: avoid deadlock on failure paths in __intel_framebuffer_create()

commit 6ccb81f2 upstream.

Since a8bb6818 __intel_framebuffer_create() is called
with struct_mutex held, so it should use drm_gem_object_unreference()
instead of drm_gem_object_unreference_unlocked().

Found by Linux Driver Verification project (linuxtesting.org).

This regression has been introduced in

commit a8bb6818
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Mon Feb 10 18:00:39 2014 +0100

    drm/i915: Fix error path leak in fbdev fb allocation
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent f703dc9d
...@@ -8220,7 +8220,7 @@ __intel_framebuffer_create(struct drm_device *dev, ...@@ -8220,7 +8220,7 @@ __intel_framebuffer_create(struct drm_device *dev,
intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL); intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
if (!intel_fb) { if (!intel_fb) {
drm_gem_object_unreference_unlocked(&obj->base); drm_gem_object_unreference(&obj->base);
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
...@@ -8230,7 +8230,7 @@ __intel_framebuffer_create(struct drm_device *dev, ...@@ -8230,7 +8230,7 @@ __intel_framebuffer_create(struct drm_device *dev,
return &intel_fb->base; return &intel_fb->base;
err: err:
drm_gem_object_unreference_unlocked(&obj->base); drm_gem_object_unreference(&obj->base);
kfree(intel_fb); kfree(intel_fb);
return ERR_PTR(ret); return ERR_PTR(ret);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment