Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Use-after-free error

  • Loading branch information...
commit 4b85b52b42de60c2f7b6a174bafc085d32bd8b07 1 parent edf0adb
Alexander Polakov authored
Showing with 3 additions and 1 deletion.
  1. +1 −0  pscnv/nv50_chan.c
  2. +1 −0  pscnv/nvc0_chan.c
  3. +1 −1  pscnv/pscnv_chan.c
View
1  pscnv/nv50_chan.c
@@ -146,6 +146,7 @@ static void nv50_chan_free(struct pscnv_chan *ch) {
ch->handle = 0;
spin_unlock_irqrestore(&dev_priv->chan->ch_lock, flags);
pscnv_mem_free(ch->bo);
+ ch->bo = NULL;
if (ch->cache)
pscnv_mem_free(ch->cache);
mutex_lock(&ch->vspace->lock);
View
1  pscnv/nvc0_chan.c
@@ -45,6 +45,7 @@ static void nvc0_chan_free(struct pscnv_chan *ch)
ch->handle = 0;
spin_unlock_irqrestore(&dev_priv->chan->ch_lock, flags);
pscnv_mem_free(ch->bo);
+ ch->bo = NULL;
}
static void
View
2  pscnv/pscnv_chan.c
@@ -127,7 +127,7 @@ void pscnv_chan_ref_free(struct kref *ref) {
}
dev_priv->chan->do_chan_free(ch);
pscnv_chan_unbind(ch);
- if (ch->bo->gem)
+ if (ch->bo && ch->bo->gem)
drm_gem_object_unreference_unlocked(ch->bo->gem);
if (ch->vspace)
pscnv_vspace_unref(ch->vspace);
Please sign in to comment.
Something went wrong with that request. Please try again.