mirror of
https://github.com/torvalds/linux.git
synced 2024-11-25 21:51:40 +00:00
drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state
When the atomic support was added to nouveau, the DRM core did not do this. However, later in the same merge window, a commit (drm/fence: add in-fences support) was merged that added it, leading to use-after-frees of the fence object. Cc: stable@vger.kernel.org [4.10+] Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This commit is contained in:
parent
d639fbcc10
commit
2907e8670b
@ -995,7 +995,6 @@ nv50_wndw_atomic_destroy_state(struct drm_plane *plane,
|
||||
{
|
||||
struct nv50_wndw_atom *asyw = nv50_wndw_atom(state);
|
||||
__drm_atomic_helper_plane_destroy_state(&asyw->state);
|
||||
dma_fence_put(asyw->state.fence);
|
||||
kfree(asyw);
|
||||
}
|
||||
|
||||
@ -1007,7 +1006,6 @@ nv50_wndw_atomic_duplicate_state(struct drm_plane *plane)
|
||||
if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL)))
|
||||
return NULL;
|
||||
__drm_atomic_helper_plane_duplicate_state(plane, &asyw->state);
|
||||
asyw->state.fence = NULL;
|
||||
asyw->interval = 1;
|
||||
asyw->sema = armw->sema;
|
||||
asyw->ntfy = armw->ntfy;
|
||||
|
Loading…
Reference in New Issue
Block a user