diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-07-19 08:46:27 +0300 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2013-07-19 08:58:42 +0200 |
| commit | 6286ef9b56bfc5d4f3f06ef5488e41da4480dc85 (patch) | |
| tree | fc2ee8f47223de7f9e9148579d518af33ed01bc2 /drivers/gpu/drm/i915/i915_gem.c | |
| parent | db473b36d4a2eb02c65aefca11578698b3699fe0 (diff) | |
drm/i915: use after free on error path
i915_gem_vma_destroy() frees its argument so we have to move the
drm_mm_remove_node() call up a few lines.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 56642d8eb93..ce043f14eab 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3182,9 +3182,9 @@ search_free: return 0; err_out: + drm_mm_remove_node(&vma->node); i915_gem_vma_destroy(vma); i915_gem_object_unpin_pages(obj); - drm_mm_remove_node(&vma->node); return ret; } |