From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753693AbbIIMu7 (ORCPT ); Wed, 9 Sep 2015 08:50:59 -0400 Received: from mail-pa0-f45.google.com ([209.85.220.45]:35783 "EHLO mail-pa0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750959AbbIIMut (ORCPT ); Wed, 9 Sep 2015 08:50:49 -0400 From: Sudip Mukherjee To: David Airlie , Daniel Vetter Cc: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Sudip Mukherjee Subject: [PATCH] drm/gma500: fix double freeing Date: Wed, 9 Sep 2015 18:20:40 +0530 Message-Id: <1441803040-15998-1-git-send-email-sudipm.mukherjee@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If backing->stolen is true then we were freeing backing by calling psb_gtt_free_range() but we called it again after unlocking the mutex. Lets make it NULL after freeing in psb_gtt_free_range() and check for NULL before calling the function for the second time. Signed-off-by: Sudip Mukherjee --- drivers/gpu/drm/gma500/framebuffer.c | 3 ++- drivers/gpu/drm/gma500/gtt.c | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c index 2eaf1b3..381d7af 100644 --- a/drivers/gpu/drm/gma500/framebuffer.c +++ b/drivers/gpu/drm/gma500/framebuffer.c @@ -474,7 +474,8 @@ out_unref: drm_fb_helper_release_fbi(&fbdev->psb_fb_helper); out_err1: mutex_unlock(&dev->struct_mutex); - psb_gtt_free_range(dev, backing); + if (backing) + psb_gtt_free_range(dev, backing); return ret; } diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c index ce015db..8130fa8 100644 --- a/drivers/gpu/drm/gma500/gtt.c +++ b/drivers/gpu/drm/gma500/gtt.c @@ -385,6 +385,7 @@ void psb_gtt_free_range(struct drm_device *dev, struct gtt_range *gt) WARN_ON(gt->in_gart && !gt->stolen); release_resource(>->resource); kfree(gt); + gt = NULL; } static void psb_gtt_alloc(struct drm_device *dev) -- 1.9.1