summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorJerome Glisse <jglisse@redhat.com>2010-02-11 12:44:32 +0100
committerDave Airlie <airlied@redhat.com>2010-02-12 06:48:33 +1000
commit7cb72ef4d39978e6e07415a2d552b06d567c3079 (patch)
tree122dd81c7be26b25f85cfb6261626d6589d503cb /drivers
parent82568565683b4991964a5fc89a9ca0c7122818e8 (diff)
drm/radeon/kms: fix r600/r700 cs checker to avoid double kfree
radeon_cs kfree the tracker structure but for r6xx/r7xx we want to kfree it inside the parse function because we share it with the UMS code path. Set tracker to NULL after freeing it will avoid double free. Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/gpu/drm/radeon/r600_cs.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index ac67d6488a9..00e69c585fb 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -846,9 +846,9 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx
"0x%04X\n", reg);
return -EINVAL;
}
+ tmp = (reg - CB_COLOR0_BASE) / 4;
track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
- tmp = (reg - CB_COLOR0_BASE) / 4;
track->cb_color_base_last[tmp] = ib[idx];
track->cb_color_bo[tmp] = reloc->robj;
break;
@@ -1324,6 +1324,8 @@ int r600_cs_parse(struct radeon_cs_parser *p)
do {
r = r600_cs_packet_parse(p, &pkt, p->idx);
if (r) {
+ kfree(p->track);
+ p->track = NULL;
return r;
}
p->idx += pkt.count + 2;
@@ -1339,10 +1341,12 @@ int r600_cs_parse(struct radeon_cs_parser *p)
default:
DRM_ERROR("Unknown packet type %d !\n", pkt.type);
kfree(p->track);
+ p->track = NULL;
return -EINVAL;
}
if (r) {
kfree(p->track);
+ p->track = NULL;
return r;
}
} while (p->idx < p->chunks[p->chunk_ib_idx].length_dw);
@@ -1353,6 +1357,7 @@ int r600_cs_parse(struct radeon_cs_parser *p)
}
#endif
kfree(p->track);
+ p->track = NULL;
return 0;
}