[PATCH] drm/i915: Fix a use-after-free in intel_execlists_retire_requests

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Remove request from list before unreferencing it, in case it's actually
the only reference. (Found by Tvrtko Ursulin)

Signed-off-by: Nick Hoath <nicholas.hoath@xxxxxxxxx>
---
 drivers/gpu/drm/i915/intel_lrc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 70e449b..a94346f 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -732,8 +732,8 @@ void intel_execlists_retire_requests(struct intel_engine_cs *ring)
 			intel_lr_context_unpin(ring, ctx);
 		intel_runtime_pm_put(dev_priv);
 		i915_gem_context_unreference(ctx);
-		i915_gem_request_unreference(req);
 		list_del(&req->execlist_link);
+		i915_gem_request_unreference(req);
 	}
 }
 
-- 
2.1.1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/intel-gfx





[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]
  Powered by Linux