Commit 6ccb81f2 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Daniel Vetter

drm/i915: avoid deadlock on failure paths in __intel_framebuffer_create()

Since a8bb6818 __intel_framebuffer_create() is called
with struct_mutex held, so it should use drm_gem_object_unreference()
instead of drm_gem_object_unreference_unlocked().

Found by Linux Driver Verification project (linuxtesting.org).

This regression has been introduced in

commit a8bb6818
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Mon Feb 10 18:00:39 2014 +0100

    drm/i915: Fix error path leak in fbdev fb allocation
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent e1f234bd
......@@ -8421,7 +8421,7 @@ __intel_framebuffer_create(struct drm_device *dev,
intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
if (!intel_fb) {
drm_gem_object_unreference_unlocked(&obj->base);
drm_gem_object_unreference(&obj->base);
return ERR_PTR(-ENOMEM);
}
......@@ -8431,7 +8431,7 @@ __intel_framebuffer_create(struct drm_device *dev,
return &intel_fb->base;
err:
drm_gem_object_unreference_unlocked(&obj->base);
drm_gem_object_unreference(&obj->base);
kfree(intel_fb);
return ERR_PTR(ret);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment