A race condition exists in drm_vblank_cleanup() if the vblank disable timer callback runs after freeing the memory that its callback function tries to access. Fix this by deleting the timer synchronously. Signed-off-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx> --- drivers/gpu/drm/drm_irq.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c index c869436..acd2cb4 100644 --- a/drivers/gpu/drm/drm_irq.c +++ b/drivers/gpu/drm/drm_irq.c @@ -189,7 +189,7 @@ void drm_vblank_cleanup(struct drm_device *dev) if (dev->num_crtcs == 0) return; - del_timer(&dev->vblank_disable_timer); + del_timer_sync(&dev->vblank_disable_timer); vblank_disable_fn((unsigned long)dev); -- 1.7.3.4 _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/dri-devel
