On Wed, 13 Dec 2023 14:44:31 +0000, Donald Robson wrote: > It is possible to double free the vm_ctx->mmu_ctx object in this > function. > > 630 err_page_table_destroy: > --> 631 pvr_mmu_context_destroy(vm_ctx->mmu_ctx); > > The pvr_vm_context_put() function does: > > [...] Applied to drm/drm-misc (drm-misc-next-fixes). Thanks! Maxime