From patchwork Thu Oct 22 16:40:22 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Deucher X-Patchwork-Id: 7465911 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 943889F443 for ; Thu, 22 Oct 2015 16:40:36 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id B604620867 for ; Thu, 22 Oct 2015 16:40:35 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 23A4A20860 for ; Thu, 22 Oct 2015 16:40:34 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 8EFCD6F004; Thu, 22 Oct 2015 09:40:31 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-yk0-f171.google.com (mail-yk0-f171.google.com [209.85.160.171]) by gabe.freedesktop.org (Postfix) with ESMTPS id D422F8912F for ; Thu, 22 Oct 2015 09:40:30 -0700 (PDT) Received: by ykdr3 with SMTP id r3so88461952ykd.1 for ; Thu, 22 Oct 2015 09:40:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=mFOYPJcnlqSzhozr1U2aLFQ0OC7k0+YKgwORkoYJKic=; b=Zmg1A4kYaLiX2WL3Vyvgd1yBEiM4hSjRYRTXolJ3v2nV7p30lYB9BI9iI5QtNcmX4N 6nwRawlWNzBNBpxxhcEdxOdeG6RRSGNVAVtD9/5WkIafoUCJjQB9jgfgOhT6U4A5D8vR Si4DPB5cQta4ftFac5gTI4wPUby/n38cF1v9eqbXA/jArC4xLBTo5xAJhYzAqwhGgOui EH4L5CM9ss5BOdYdgwGlF97qMYq4r+3uHNia0kzKVSc1/hoJBZQu3J/pa5X5dImapY6Y NlSg5vxrbp+JWOYtYFAyqRnd9Hl7i9zmDTVm1noXNFa8eCZBbFRje0KZ/TjAdFy7AL1x hhGQ== X-Received: by 10.129.119.4 with SMTP id s4mr13028127ywc.67.1445532030198; Thu, 22 Oct 2015 09:40:30 -0700 (PDT) Received: from localhost.localdomain (static-74-96-105-49.washdc.fios.verizon.net. [74.96.105.49]) by smtp.gmail.com with ESMTPSA id q4sm10378921ywf.32.2015.10.22.09.40.29 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 22 Oct 2015 09:40:29 -0700 (PDT) From: Alex Deucher X-Google-Original-From: Alex Deucher To: dri-devel@lists.freedesktop.org Subject: [PATCH 2/3] amdgpu: Fix use-after-free bug in vamgr_deinit Date: Thu, 22 Oct 2015 12:40:22 -0400 Message-Id: <1445532023-16778-2-git-send-email-alexander.deucher@amd.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1445532023-16778-1-git-send-email-alexander.deucher@amd.com> References: <1445532023-16778-1-git-send-email-alexander.deucher@amd.com> Cc: Tom St Denis X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Tom St Denis This patch fixes a use-after-free bug in the vamgr_deinit function. Signed-off-by: Tom St Denis Reviewed-by: Alex Deucher --- amdgpu/amdgpu_vamgr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/amdgpu/amdgpu_vamgr.c b/amdgpu/amdgpu_vamgr.c index 2221da0..8a707cb 100644 --- a/amdgpu/amdgpu_vamgr.c +++ b/amdgpu/amdgpu_vamgr.c @@ -57,8 +57,8 @@ drm_private void amdgpu_vamgr_init(struct amdgpu_bo_va_mgr *mgr, uint64_t start, drm_private void amdgpu_vamgr_deinit(struct amdgpu_bo_va_mgr *mgr) { - struct amdgpu_bo_va_hole *hole; - LIST_FOR_EACH_ENTRY(hole, &mgr->va_holes, list) { + struct amdgpu_bo_va_hole *hole, *tmp; + LIST_FOR_EACH_ENTRY_SAFE(hole, tmp, &mgr->va_holes, list) { list_del(&hole->list); free(hole); }