From patchwork Wed Sep 9 12:50:40 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sudip Mukherjee X-Patchwork-Id: 7146291 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 63DE29F326 for ; Wed, 9 Sep 2015 12:50:53 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 88E8A204AD for ; Wed, 9 Sep 2015 12:50:52 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 7AEB2204A2 for ; Wed, 9 Sep 2015 12:50:51 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B6ADB6EB2C; Wed, 9 Sep 2015 05:50:50 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-pa0-f42.google.com (mail-pa0-f42.google.com [209.85.220.42]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6CF816EB2C for ; Wed, 9 Sep 2015 05:50:49 -0700 (PDT) Received: by pacfv12 with SMTP id fv12so9925967pac.2 for ; Wed, 09 Sep 2015 05:50:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=XVmlzcFZZ7KMZAaMls2nej0boLPN4wdhewYgbzgF/ts=; b=yYuNmB46P8nzv/7mqRtEr5FXOj2d9emh6yWz2xm+fK8pnh4frBpi2TSAyK4H7DWcEG hyQ94SN90AcNo/yhgNTC/6M6VO1lNXGfy33NGqj/VMDpcJTgBr+z2egxxEmce016BP3v bndbvBMViZcK2DA/E5g9WwnuKqEQJcVpgG9F09PpInxafE9IjyqtrW8caLDnoiu549hX Ca1UuiD/3eTBpFUSk87uG24xAabZYCgsmPBVGaw4ZnuVMWfyhm1GVXfvqCS5gCIWfgJq D4xJC9NymFPJce2apei/0EhaxnAtu8bBx19R4U9E3gQ7t0IXcH4B91U6KP+mZvEW1D1p m3fg== X-Received: by 10.66.142.132 with SMTP id rw4mr61080132pab.19.1441803048875; Wed, 09 Sep 2015 05:50:48 -0700 (PDT) Received: from localhost.localdomain ([49.206.249.93]) by smtp.gmail.com with ESMTPSA id qe3sm6961552pbc.73.2015.09.09.05.50.46 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 09 Sep 2015 05:50:48 -0700 (PDT) From: Sudip Mukherjee To: David Airlie , Daniel Vetter Subject: [PATCH] drm/gma500: fix double freeing Date: Wed, 9 Sep 2015 18:20:40 +0530 Message-Id: <1441803040-15998-1-git-send-email-sudipm.mukherjee@gmail.com> X-Mailer: git-send-email 1.9.1 Cc: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Sudip Mukherjee X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If backing->stolen is true then we were freeing backing by calling psb_gtt_free_range() but we called it again after unlocking the mutex. Lets make it NULL after freeing in psb_gtt_free_range() and check for NULL before calling the function for the second time. Signed-off-by: Sudip Mukherjee --- drivers/gpu/drm/gma500/framebuffer.c | 3 ++- drivers/gpu/drm/gma500/gtt.c | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c index 2eaf1b3..381d7af 100644 --- a/drivers/gpu/drm/gma500/framebuffer.c +++ b/drivers/gpu/drm/gma500/framebuffer.c @@ -474,7 +474,8 @@ out_unref: drm_fb_helper_release_fbi(&fbdev->psb_fb_helper); out_err1: mutex_unlock(&dev->struct_mutex); - psb_gtt_free_range(dev, backing); + if (backing) + psb_gtt_free_range(dev, backing); return ret; } diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c index ce015db..8130fa8 100644 --- a/drivers/gpu/drm/gma500/gtt.c +++ b/drivers/gpu/drm/gma500/gtt.c @@ -385,6 +385,7 @@ void psb_gtt_free_range(struct drm_device *dev, struct gtt_range *gt) WARN_ON(gt->in_gart && !gt->stolen); release_resource(>->resource); kfree(gt); + gt = NULL; } static void psb_gtt_alloc(struct drm_device *dev)