I don't totally understand the stack trace but I do see a double free
bug.
drivers/gpu/drm/vgem/vgem_drv.c
186 static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
187 struct drm_file *file,
188 unsigned int *handle,
189 unsigned long size)
190 {
191 struct drm_vgem_gem_object *obj;
192 int ret;
193
194 obj = __vgem_gem_create(dev, size);
obj->base.handle_count is zero.
195 if (IS_ERR(obj))
196 return ERR_CAST(obj);
197
198 ret = drm_gem_handle_create(file, &obj->base, handle);
We bump it +1 and then the error handling calls
drm_gem_object_handle_put_unlocked(obj);
which calls drm_gem_object_put_unlocked(); which frees obj.
199 drm_gem_object_put_unlocked(&obj->base);
So this is a double free. Could someone check my thinking and send
a patch? It's just a one liner. Otherwise I can send it on Monday.
200 if (ret)
201 return ERR_PTR(ret);
202
203 return &obj->base;
204 }
regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
