提交 6ccb81f2 编写于 作者: A Alexey Khoroshilov 提交者: Daniel Vetter

drm/i915: avoid deadlock on failure paths in __intel_framebuffer_create()

Since a8bb6818 __intel_framebuffer_create() is called
with struct_mutex held, so it should use drm_gem_object_unreference()
instead of drm_gem_object_unreference_unlocked().

Found by Linux Driver Verification project (linuxtesting.org).

This regression has been introduced in

commit a8bb6818
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Mon Feb 10 18:00:39 2014 +0100

    drm/i915: Fix error path leak in fbdev fb allocation
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
上级 e1f234bd
......@@ -8421,7 +8421,7 @@ __intel_framebuffer_create(struct drm_device *dev,
intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
if (!intel_fb) {
drm_gem_object_unreference_unlocked(&obj->base);
drm_gem_object_unreference(&obj->base);
return ERR_PTR(-ENOMEM);
}
......@@ -8431,7 +8431,7 @@ __intel_framebuffer_create(struct drm_device *dev,
return &intel_fb->base;
err:
drm_gem_object_unreference_unlocked(&obj->base);
drm_gem_object_unreference(&obj->base);
kfree(intel_fb);
return ERR_PTR(ret);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册