[PATCH] drm/radeon: fix rare segfault

[Alex Deucher]

On Mon, Jul 2, 2012 at 12:40 PM,  <j.glisse at gmail.com> wrote:
> From: Jerome Glisse <jglisse at redhat.com>
>
> In gem idle/busy ioctl the radeon object was derefenced after
> drm_gem_object_unreference_unlocked which in case the object
> have been destroyed lead to use of a possibly free pointer with
> possibly wrong data.
>
> Signed-off-by: Jerome Glisse <jglisse at redhat.com>

Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

> ---
>  drivers/gpu/drm/radeon/radeon_gem.c |   10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
> index 74176c5..c8838fc 100644
> --- a/drivers/gpu/drm/radeon/radeon_gem.c
> +++ b/drivers/gpu/drm/radeon/radeon_gem.c
> @@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
>  int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
>                           struct drm_file *filp)
>  {
> +       struct radeon_device *rdev = dev->dev_private;
>         struct drm_radeon_gem_busy *args = data;
>         struct drm_gem_object *gobj;
>         struct radeon_bo *robj;
> @@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
>                 break;
>         }
>         drm_gem_object_unreference_unlocked(gobj);
> -       r = radeon_gem_handle_lockup(robj->rdev, r);
> +       r = radeon_gem_handle_lockup(rdev, r);
>         return r;
>  }
>
>  int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
>                               struct drm_file *filp)
>  {
> +       struct radeon_device *rdev = dev->dev_private;
>         struct drm_radeon_gem_wait_idle *args = data;
>         struct drm_gem_object *gobj;
>         struct radeon_bo *robj;
> @@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
>         robj = gem_to_radeon_bo(gobj);
>         r = radeon_bo_wait(robj, NULL, false);
>         /* callback hw specific functions if any */
> -       if (robj->rdev->asic->ioctl_wait_idle)
> -               robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
> +       if (rdev->asic->ioctl_wait_idle)
> +               robj->rdev->asic->ioctl_wait_idle(rdev, robj);
>         drm_gem_object_unreference_unlocked(gobj);
> -       r = radeon_gem_handle_lockup(robj->rdev, r);
> +       r = radeon_gem_handle_lockup(rdev, r);
>         return r;
>  }
>
> --
> 1.7.10.2
>
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel