提交 7cb72ef4 编写于 作者: J Jerome Glisse 提交者: Dave Airlie

drm/radeon/kms: fix r600/r700 cs checker to avoid double kfree

radeon_cs kfree the tracker structure but for r6xx/r7xx we want
to kfree it inside the parse function because we share it with
the UMS code path. Set tracker to NULL after freeing it will
avoid double free.
Signed-off-by: NJerome Glisse <jglisse@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>
上级 82568565
...@@ -846,9 +846,9 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx ...@@ -846,9 +846,9 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx
"0x%04X\n", reg); "0x%04X\n", reg);
return -EINVAL; return -EINVAL;
} }
tmp = (reg - CB_COLOR0_BASE) / 4;
track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx); track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff); ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
tmp = (reg - CB_COLOR0_BASE) / 4;
track->cb_color_base_last[tmp] = ib[idx]; track->cb_color_base_last[tmp] = ib[idx];
track->cb_color_bo[tmp] = reloc->robj; track->cb_color_bo[tmp] = reloc->robj;
break; break;
...@@ -1324,6 +1324,8 @@ int r600_cs_parse(struct radeon_cs_parser *p) ...@@ -1324,6 +1324,8 @@ int r600_cs_parse(struct radeon_cs_parser *p)
do { do {
r = r600_cs_packet_parse(p, &pkt, p->idx); r = r600_cs_packet_parse(p, &pkt, p->idx);
if (r) { if (r) {
kfree(p->track);
p->track = NULL;
return r; return r;
} }
p->idx += pkt.count + 2; p->idx += pkt.count + 2;
...@@ -1339,10 +1341,12 @@ int r600_cs_parse(struct radeon_cs_parser *p) ...@@ -1339,10 +1341,12 @@ int r600_cs_parse(struct radeon_cs_parser *p)
default: default:
DRM_ERROR("Unknown packet type %d !\n", pkt.type); DRM_ERROR("Unknown packet type %d !\n", pkt.type);
kfree(p->track); kfree(p->track);
p->track = NULL;
return -EINVAL; return -EINVAL;
} }
if (r) { if (r) {
kfree(p->track); kfree(p->track);
p->track = NULL;
return r; return r;
} }
} while (p->idx < p->chunks[p->chunk_ib_idx].length_dw); } while (p->idx < p->chunks[p->chunk_ib_idx].length_dw);
...@@ -1353,6 +1357,7 @@ int r600_cs_parse(struct radeon_cs_parser *p) ...@@ -1353,6 +1357,7 @@ int r600_cs_parse(struct radeon_cs_parser *p)
} }
#endif #endif
kfree(p->track); kfree(p->track);
p->track = NULL;
return 0; return 0;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册