From patchwork Thu Dec 9 05:35:40 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 392962 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id oB95ab2Z009191 for ; Thu, 9 Dec 2010 05:36:58 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 391E89E85F for ; Wed, 8 Dec 2010 21:36:37 -0800 (PST) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-ww0-f43.google.com (mail-ww0-f43.google.com [74.125.82.43]) by gabe.freedesktop.org (Postfix) with ESMTP id DEB1E9E746 for ; Wed, 8 Dec 2010 21:36:28 -0800 (PST) Received: by wwi17 with SMTP id 17so1934840wwi.12 for ; Wed, 08 Dec 2010 21:36:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:mime-version:content-type:content-disposition:user-agent; bh=Jrk1PYgxXXtydKqfPf8xfNQM0sE0r0z9R6ywaX/VF6c=; b=dLJ5i2i6FvOqvoQYyd9W3vu4cfrHBLYPnqIS+jpjwoXK4atkkumFxisWqelmJhCcgm P8du1X8mJ+I2QFCBoyRSRyy8iqNQ5sI2/7nMxzPV2xV3EANh3zDP00HSPL7MQzFBV7TE oJR13s8xuLpzbvyDOzZvuqUVdLFe8tUyu1DDI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=DVtO5Fw4KBQIrzWGsPV6Xy1q2gqvj0b5gbz8QFDfQKVBm4mbeZ5pgF578bM8M3awem glwffTkdPEQVSTOKJsE1z7sfG6twhTroKvBfcTW5G0AnBWB/AgC2qXkx3lPvDNqLO5GM ox58h5wweIuCMGUvIyWkNRHX+jcWpmkvDFpos= Received: by 10.227.157.11 with SMTP id z11mr9936465wbw.122.1291872987249; Wed, 08 Dec 2010 21:36:27 -0800 (PST) Received: from bicker (h14ba.n2.ips.mtn.co.ug [212.88.116.186]) by mx.google.com with ESMTPS id 11sm956118wbi.18.2010.12.08.21.36.14 (version=TLSv1/SSLv3 cipher=RC4-MD5); Wed, 08 Dec 2010 21:36:26 -0800 (PST) Date: Thu, 9 Dec 2010 08:35:40 +0300 From: Dan Carpenter To: David Airlie Subject: [patch] drm: use after free in drm_queue_vblank_event() Message-ID: <20101209053540.GR10623@bicker> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.20 (2009-06-14) Cc: kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter1.kernel.org [140.211.167.41]); Thu, 09 Dec 2010 05:36:58 +0000 (UTC) diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c index 722700d..16d5155 100644 --- a/drivers/gpu/drm/drm_irq.c +++ b/drivers/gpu/drm/drm_irq.c @@ -628,7 +628,7 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe, if ((seq - vblwait->request.sequence) <= (1 << 23)) { e->event.tv_sec = now.tv_sec; e->event.tv_usec = now.tv_usec; - drm_vblank_put(dev, e->pipe); + drm_vblank_put(dev, pipe); list_add_tail(&e->base.link, &e->base.file_priv->event_list); wake_up_interruptible(&e->base.file_priv->event_wait); trace_drm_vblank_event_delivered(current->pid, pipe, @@ -645,7 +645,7 @@ err_unlock: spin_unlock_irqrestore(&dev->event_lock, flags); kfree(e); err_put: - drm_vblank_put(dev, e->pipe); + drm_vblank_put(dev, pipe); return ret; }