diff options
| author | Nick Hoath <nicholas.hoath@intel.com> | 2015-01-29 16:55:07 +0000 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2015-01-30 19:38:13 +0100 |
| commit | f82107950e9bda3779610e37bdfdccae6fc16f87 (patch) | |
| tree | 8e1a3a04253a1741dd0626b1dd5c9f7e623d8bb0 /drivers/gpu/drm/i915 | |
| parent | ed6739efc95e8c049f67000586f6317f3914a696 (diff) | |
drm/i915: Fix a use-after-free in intel_execlists_retire_requests
Remove request from list before unreferencing it, in case it's actually
the only reference. (Found by Tvrtko Ursulin)
This issue has been most likely introduced in
commit 6d3d8274bc45de4babb62d64562d92af984dd238
Author: Nick Hoath <nicholas.hoath@intel.com>
Date: Thu Jan 15 13:10:39 2015 +0000
drm/i915: Subsume intel_ctx_submit_request in to drm_i915_gem_request
Signed-off-by: Nick Hoath <nicholas.hoath@intel.com>
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'drivers/gpu/drm/i915')
| -rw-r--r-- | drivers/gpu/drm/i915/intel_lrc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c index 70e449b702c..a94346fee16 100644 --- a/drivers/gpu/drm/i915/intel_lrc.c +++ b/drivers/gpu/drm/i915/intel_lrc.c @@ -732,8 +732,8 @@ void intel_execlists_retire_requests(struct intel_engine_cs *ring) intel_lr_context_unpin(ring, ctx); intel_runtime_pm_put(dev_priv); i915_gem_context_unreference(ctx); - i915_gem_request_unreference(req); list_del(&req->execlist_link); + i915_gem_request_unreference(req); } } |