Commit df60d1f2 authored by Ben Skeggs's avatar Ben Skeggs

drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state

When the atomic support was added to nouveau, the DRM core did not do this.

However, later in the same merge window, a commit (drm/fence: add in-fences
support) was merged that added it, leading to use-after-frees of the fence
object.

Cc: stable@vger.kernel.org	[4.10+]
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent aeecfcd7
...@@ -1002,7 +1002,6 @@ nv50_wndw_atomic_destroy_state(struct drm_plane *plane, ...@@ -1002,7 +1002,6 @@ nv50_wndw_atomic_destroy_state(struct drm_plane *plane,
{ {
struct nv50_wndw_atom *asyw = nv50_wndw_atom(state); struct nv50_wndw_atom *asyw = nv50_wndw_atom(state);
__drm_atomic_helper_plane_destroy_state(&asyw->state); __drm_atomic_helper_plane_destroy_state(&asyw->state);
dma_fence_put(asyw->state.fence);
kfree(asyw); kfree(asyw);
} }
...@@ -1014,7 +1013,6 @@ nv50_wndw_atomic_duplicate_state(struct drm_plane *plane) ...@@ -1014,7 +1013,6 @@ nv50_wndw_atomic_duplicate_state(struct drm_plane *plane)
if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL))) if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL)))
return NULL; return NULL;
__drm_atomic_helper_plane_duplicate_state(plane, &asyw->state); __drm_atomic_helper_plane_duplicate_state(plane, &asyw->state);
asyw->state.fence = NULL;
asyw->interval = 1; asyw->interval = 1;
asyw->sema = armw->sema; asyw->sema = armw->sema;
asyw->ntfy = armw->ntfy; asyw->ntfy = armw->ntfy;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment