On Mon, Jul 2, 2012 at 12:40 PM, j.glisse@gmail.com wrote:
From: Jerome Glisse jglisse@redhat.com
In gem idle/busy ioctl the radeon object was derefenced after drm_gem_object_unreference_unlocked which in case the object have been destroyed lead to use of a possibly free pointer with possibly wrong data.
Signed-off-by: Jerome Glisse jglisse@redhat.com
Reviewed-by: Alex Deucher alexander.deucher@amd.com
drivers/gpu/drm/radeon/radeon_gem.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c index 74176c5..c8838fc 100644 --- a/drivers/gpu/drm/radeon/radeon_gem.c +++ b/drivers/gpu/drm/radeon/radeon_gem.c @@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data, int radeon_gem_busy_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) {
struct radeon_device *rdev = dev->dev_private; struct drm_radeon_gem_busy *args = data; struct drm_gem_object *gobj; struct radeon_bo *robj;@@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data, break; } drm_gem_object_unreference_unlocked(gobj);
r = radeon_gem_handle_lockup(robj->rdev, r);
r = radeon_gem_handle_lockup(rdev, r); return r;}
int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) {
struct radeon_device *rdev = dev->dev_private; struct drm_radeon_gem_wait_idle *args = data; struct drm_gem_object *gobj; struct radeon_bo *robj;@@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data, robj = gem_to_radeon_bo(gobj); r = radeon_bo_wait(robj, NULL, false); /* callback hw specific functions if any */
if (robj->rdev->asic->ioctl_wait_idle)robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
if (rdev->asic->ioctl_wait_idle)robj->rdev->asic->ioctl_wait_idle(rdev, robj); drm_gem_object_unreference_unlocked(gobj);
r = radeon_gem_handle_lockup(robj->rdev, r);
r = radeon_gem_handle_lockup(rdev, r); return r;}
-- 1.7.10.2
dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel