Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1765687AbdDSPcZ (ORCPT ); Wed, 19 Apr 2017 11:32:25 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:45146 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935013AbdDSOiG (ORCPT ); Wed, 19 Apr 2017 10:38:06 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Skeggs Subject: [PATCH 4.10 13/69] drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state Date: Wed, 19 Apr 2017 16:36:42 +0200 Message-Id: <20170419141555.641909871@linuxfoundation.org> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170419141555.114738231@linuxfoundation.org> References: <20170419141555.114738231@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1254 Lines: 40 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ben Skeggs commit 2907e8670b6ef253bffb33bf47fd2182969cf2a0 upstream. When the atomic support was added to nouveau, the DRM core did not do this. However, later in the same merge window, a commit (drm/fence: add in-fences support) was merged that added it, leading to use-after-frees of the fence object. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/nouveau/nv50_display.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/gpu/drm/nouveau/nv50_display.c +++ b/drivers/gpu/drm/nouveau/nv50_display.c @@ -995,7 +995,6 @@ nv50_wndw_atomic_destroy_state(struct dr { struct nv50_wndw_atom *asyw = nv50_wndw_atom(state); __drm_atomic_helper_plane_destroy_state(&asyw->state); - dma_fence_put(asyw->state.fence); kfree(asyw); } @@ -1007,7 +1006,6 @@ nv50_wndw_atomic_duplicate_state(struct if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL))) return NULL; __drm_atomic_helper_plane_duplicate_state(plane, &asyw->state); - asyw->state.fence = NULL; asyw->interval = 1; asyw->sema = armw->sema; asyw->ntfy = armw->ntfy;