Merge with DRI CVS tree: fix use-after-free bug in DRM(takedown)

drivers/char/drm/drm_drv.h

@@ -452,15 +452,10 @@ static int DRM(takedown)( drm_device_t *dev )
 	}
 
 	if( dev->maplist ) {
-		for(list = dev->maplist->head.next;
-		    list != &dev->maplist->head;
-		    list = list_next) {
-			list_next = list->next;
+		list_for_each_safe( list, list_next, &dev->maplist->head ) {
 			r_list = (drm_map_list_t *)list;
-			map = r_list->map;
-			DRM(free)(r_list, sizeof(*r_list), DRM_MEM_MAPS);
-			if(!map) continue;
 
+			if ( ( map = r_list->map ) ) {
 				switch ( map->type ) {
 				case _DRM_REGISTERS:
 				case _DRM_FRAME_BUFFER:
@@ -498,6 +493,9 @@ static int DRM(takedown)( drm_device_t *dev )
 				}
 				DRM(free)(map, sizeof(*map), DRM_MEM_MAPS);
 			}
+			list_del( list );
+			DRM(free)(r_list, sizeof(*r_list), DRM_MEM_MAPS);
+ 		}
 		DRM(free)(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
 		dev->maplist = NULL;
  	}