summaryrefslogtreecommitdiff
path: root/corking.c
AgeCommit message (Expand)AuthorFilesLines
2013-06-15misc: remove two header commentsDaniel Borkmann1-6/+0
2013-06-04corking: use bool instead of intDaniel Borkmann1-4/+4
2013-06-04corking: break out udp/tcp cork functionsDaniel Borkmann1-0/+66
-12-20 16:30:27 +0200 commitd8953c8326d87a337763ca547ad7db034a94ddb1 (patch) treec992f007daa44dbe82bbeb284f742e150647a131 parent1c4672ce4eeaeaadeea8adabaad21262b7172607 (diff)
drm/i915: Fix use after free in logical_render_ring_init
Commit 3b3f1650b1ca ("drm/i915: Allocate intel_engine_cs structure only for the enabled engines") introduced the dynanically allocated engine instances and created an potential use after free scenario in logical_render_ring_init where lrc_destroy_wa_ctx_obj could be called after the engine instance has been freed. This can only happen during engine setup/init error handling which luckily does not happen ever in practice. Fix is to not call lrc_destroy_wa_ctx_obj since it would have already been executed from the preceding engine cleanup. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Fixes: 3b3f1650b1ca ("drm/i915: Allocate intel_engine_cs structure only for the enabled engines") Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Link: http://patchwork.freedesktop.org/patch/msgid/1481894322-2145-1-git-send-email-tvrtko.ursulin@linux.intel.com (cherry picked from commit d038fc7e4fff14d6b026130007faef35cbf5e956) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Diffstat