diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2011-03-20 12:20:19 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2011-03-23 10:17:02 +0100 |
| commit | 26e12f894317bf0221fed40bef6f937538a78c0b (patch) | |
| tree | 2dd321afe54ee37e7022d9f12a6a854a1d3547e4 | |
| parent | drm/i915: Restore missing command flush before interrupt on BLT ring (diff) | |
| download | linux-26e12f894317bf0221fed40bef6f937538a78c0b.tar.xz linux-26e12f894317bf0221fed40bef6f937538a78c0b.zip | |
drm/i915: Fix use after free within tracepoint
Detected by scripts/coccinelle/free/kfree.cocci.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Keith Packard <keithp@keithp.com>
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index edd6098743b2..c9bdaf208a91 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3603,6 +3603,8 @@ static void i915_gem_free_object_tail(struct drm_i915_gem_object *obj) return; } + trace_i915_gem_object_destroy(obj); + if (obj->base.map_list.map) i915_gem_free_mmap_offset(obj); @@ -3612,8 +3614,6 @@ static void i915_gem_free_object_tail(struct drm_i915_gem_object *obj) kfree(obj->page_cpu_valid); kfree(obj->bit_17); kfree(obj); - - trace_i915_gem_object_destroy(obj); } void i915_gem_free_object(struct drm_gem_object *gem_obj) |