We sometimes call i915_vma_unbind() inside the loop and that can free the vma.

Signed-off-by: Dan Carpenter dan.carpenter@oracle.com --- Static checker stuff. Untested.

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c index 9b3b5f8..5249735 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -524,7 +524,7 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring, bool *need_relocs) { struct drm_i915_gem_object *obj; - struct i915_vma *vma; + struct i915_vma *vma, *n; struct list_head ordered_vmas; bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4; int retry; @@ -572,7 +572,7 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring, int ret = 0;

/* Unbind any ill-fitting objects or pin. */ - list_for_each_entry(vma, vmas, exec_list) { + list_for_each_entry_safe(vma, n, vmas, exec_list) { struct drm_i915_gem_exec_object2 *entry = vma->exec_entry; bool need_fence, need_mappable;