diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2020-01-30 13:51:36 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2020-01-30 17:22:29 +0000 |
| commit | 37b7617262bd012359a33deb887947ad7cc989f9 (patch) | |
| tree | c07885f888367dda140632426368033168c8f1ce /drivers | |
| parent | bf72c8c6ee77d46f74a2b143303a9c9923f9e7a7 (diff) | |
drm/i915/fbc: __intel_fbc_cleanup_cfb() may be called multiple times
Avoid releasing the same stolen nodes causing a use-after-free and/or
explosions as the self-checks fail, as __intel_fbc_cleanup_cfb() may be
called multiple times during module unload.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200130135136.1878646-1-chris@chris-wilson.co.uk
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/drm/i915/display/intel_fbc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/display/intel_fbc.c b/drivers/gpu/drm/i915/display/intel_fbc.c index 2a3f1333c8ff..ab676c6756af 100644 --- a/drivers/gpu/drm/i915/display/intel_fbc.c +++ b/drivers/gpu/drm/i915/display/intel_fbc.c @@ -537,13 +537,15 @@ static void __intel_fbc_cleanup_cfb(struct drm_i915_private *dev_priv) { struct intel_fbc *fbc = &dev_priv->fbc; - if (drm_mm_node_allocated(&fbc->compressed_fb)) - i915_gem_stolen_remove_node(dev_priv, &fbc->compressed_fb); + if (!drm_mm_node_allocated(&fbc->compressed_fb)) + return; if (fbc->compressed_llb) { i915_gem_stolen_remove_node(dev_priv, fbc->compressed_llb); kfree(fbc->compressed_llb); } + + i915_gem_stolen_remove_node(dev_priv, &fbc->compressed_fb); } void intel_fbc_cleanup_cfb(struct drm_i915_private *dev_priv) |