renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-04 03:33:58 +08:00
Code

drm/i915: use after free on error path

Browse Source 
i915_gem_vma_destroy() frees its argument so we have to move the
drm_mm_remove_node() call up a few lines.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
This commit is contained in:
Dan Carpenter 2013-07-19 08:46:27 +03:00 committed by Daniel Vetter
parent db473b36d4
commit 6286ef9b56
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/i915/i915_gem.c
View File

@ -3182,9 +3182,9 @@ search_free:
return 0;
err_out:
drm_mm_remove_node(&vma->node);
i915_gem_vma_destroy(vma);
i915_gem_object_unpin_pages(obj);
drm_mm_remove_node(&vma->node);
return ret;
}