| Message ID | 1350282099-9271-1-git-send-email-eich@suse.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Mon, Oct 15, 2012 at 2:21 AM, Egbert Eich <eich@suse.de> wrote: > radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[] > to destroy each of them. > radeon_ext_tmds_enc_destroy() however also has code to destroy it's > associated I2C bus rec which has been obtained by radeon_i2c_lookup() > and is therefore also in the i2c_bus[] list. > This causes a double free resulting in a kernel panic when unloading > the radeon driver. > Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this > problem. > > Signed-off-by: Egbert Eich <eich@suse.de> Looks good. I'll add it to my queue. Reviewed-by: Alex Deucher <alexander.deucher@amd.com> > --- > drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 5 +---- > 1 files changed, 1 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c > index 92487e6..429ce8f 100644 > --- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c > +++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c > @@ -992,10 +992,7 @@ static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder) > { > struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); > struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv; > - if (tmds) { > - if (tmds->i2c_bus) > - radeon_i2c_destroy(tmds->i2c_bus); > - } > + /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */ > kfree(radeon_encoder->enc_priv); > drm_encoder_cleanup(encoder); > kfree(radeon_encoder); > -- > 1.7.6.3 >
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c index 92487e6..429ce8f 100644 --- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c +++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c @@ -992,10 +992,7 @@ static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder) { struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv; - if (tmds) { - if (tmds->i2c_bus) - radeon_i2c_destroy(tmds->i2c_bus); - } + /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */ kfree(radeon_encoder->enc_priv); drm_encoder_cleanup(encoder); kfree(radeon_encoder);
radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[] to destroy each of them. radeon_ext_tmds_enc_destroy() however also has code to destroy it's associated I2C bus rec which has been obtained by radeon_i2c_lookup() and is therefore also in the i2c_bus[] list. This causes a double free resulting in a kernel panic when unloading the radeon driver. Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this problem. Signed-off-by: Egbert Eich <eich@suse.de> --- drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 5 +---- 1 files changed, 1 insertions(+), 4 deletions(-)