[Intel-gfx] [PATCH] drm/i915: Fix a use-after-free in intel_execlists_retire_requests

[Mika Kuoppala]

Nick Hoath <nicholas.hoath at intel.com> writes:

> Remove request from list before unreferencing it, in case it's actually
> the only reference. (Found by Tvrtko Ursulin)
>
> Signed-off-by: Nick Hoath <nicholas.hoath at intel.com>

Reviewed-by: Mika Kuoppala <mika.kuoppala at intel.com>

> ---
>  drivers/gpu/drm/i915/intel_lrc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
> index 70e449b..a94346f 100644
> --- a/drivers/gpu/drm/i915/intel_lrc.c
> +++ b/drivers/gpu/drm/i915/intel_lrc.c
> @@ -732,8 +732,8 @@ void intel_execlists_retire_requests(struct intel_engine_cs *ring)
>  			intel_lr_context_unpin(ring, ctx);
>  		intel_runtime_pm_put(dev_priv);
>  		i915_gem_context_unreference(ctx);
> -		i915_gem_request_unreference(req);
>  		list_del(&req->execlist_link);
> +		i915_gem_request_unreference(req);
>  	}
>  }
>  
> -- 
> 2.1.1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx