diff options
| author | YoungJun Cho <yj44.cho@samsung.com> | 2013-10-29 20:30:26 +0900 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2013-11-06 13:21:54 +1000 |
| commit | 1dda6805471d4120dba2fa0f2cc1053c2dab28de (patch) | |
| tree | fee008c7745a1e192173a67b0ec6d030ae45fd08 /drivers/gpu/drm/drm_fops.c | |
| parent | 06c5bf8cc50a0f85284c035bdebf58d230b09056 (diff) | |
| download | linux-1dda6805471d4120dba2fa0f2cc1053c2dab28de.tar.bz2 | |
drm: delete unconsumed pending event list in drm_events_release
When there are unconsumed pending events, the events are
destroyed by calling destroy callback, but the events list
are remained, because there is no list_del().
It is possible that the page flip request is handled after
drm_events_release() is called and before drm_fb_release().
In this case a drm_pending_event is remained not freed.
So exynos driver checks again to remove it in its post
close routine. But the file_priv->event_list contains
undeleted ones, this can make oops for accessing invalid
memory.
Signed-off-by: YoungJun Cho <yj44.cho@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/drm_fops.c')
| -rw-r--r-- | drivers/gpu/drm/drm_fops.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c index d0e27667a4eb..ee2d330a2fa0 100644 --- a/drivers/gpu/drm/drm_fops.c +++ b/drivers/gpu/drm/drm_fops.c @@ -378,8 +378,10 @@ static void drm_events_release(struct drm_file *file_priv) } /* Remove unconsumed events */ - list_for_each_entry_safe(e, et, &file_priv->event_list, link) + list_for_each_entry_safe(e, et, &file_priv->event_list, link) { + list_del(&e->link); e->destroy(e); + } spin_unlock_irqrestore(&dev->event_lock, flags); } |