[patch] xf86-video-intel: fix bo_list corruption
Hong Liu
hong.liu at intel.com
Mon Feb 4 01:00:49 PST 2008
bo_list is corrupted when we call i830_free_3d_memory.
This happens when the virtual size is > 2048 for non-965 machine and
it causes X server segfault because the front buffer is not binded when entering VT.
Thanks,
Hong
diff --git a/src/i830_memory.c b/src/i830_memory.c
index 5dbafee..31c8ad0 100644
--- a/src/i830_memory.c
+++ b/src/i830_memory.c
@@ -274,12 +274,16 @@ i830_free_memory(ScrnInfoPtr pScrn, i830_memory *mem)
I830Ptr pI830 = I830PTR(pScrn);
drmBOUnreference(pI830->drmSubFD, &mem->bo);
- if (pI830->bo_list == mem)
+ if (pI830->bo_list == mem) {
pI830->bo_list = mem->next;
- if (mem->next)
- mem->next->prev = NULL;
- if (mem->prev)
- mem->prev->next = NULL;
+ if (mem->next)
+ mem->next->prev = NULL;
+ } else {
+ if (mem->prev)
+ mem->prev->next = mem->next;
+ if (mem->next)
+ mem->next->prev = mem->prev;
+ }
xfree(mem->name);
xfree(mem);
return;
More information about the xorg
mailing list