From 7cb72ef4d39978e6e07415a2d552b06d567c3079 Mon Sep 17 00:00:00 2001 From: Jerome Glisse Date: Thu, 11 Feb 2010 12:44:32 +0100 Subject: [PATCH] drm/radeon/kms: fix r600/r700 cs checker to avoid double kfree radeon_cs kfree the tracker structure but for r6xx/r7xx we want to kfree it inside the parse function because we share it with the UMS code path. Set tracker to NULL after freeing it will avoid double free. Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie --- drivers/gpu/drm/radeon/r600_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c index ac67d6488a9..00e69c585fb 100644 --- a/drivers/gpu/drm/radeon/r600_cs.c +++ b/drivers/gpu/drm/radeon/r600_cs.c @@ -846,9 +846,9 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx "0x%04X\n", reg); return -EINVAL; } + tmp = (reg - CB_COLOR0_BASE) / 4; track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx); ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff); - tmp = (reg - CB_COLOR0_BASE) / 4; track->cb_color_base_last[tmp] = ib[idx]; track->cb_color_bo[tmp] = reloc->robj; break; @@ -1324,6 +1324,8 @@ int r600_cs_parse(struct radeon_cs_parser *p) do { r = r600_cs_packet_parse(p, &pkt, p->idx); if (r) { + kfree(p->track); + p->track = NULL; return r; } p->idx += pkt.count + 2; @@ -1339,10 +1341,12 @@ int r600_cs_parse(struct radeon_cs_parser *p) default: DRM_ERROR("Unknown packet type %d !\n", pkt.type); kfree(p->track); + p->track = NULL; return -EINVAL; } if (r) { kfree(p->track); + p->track = NULL; return r; } } while (p->idx < p->chunks[p->chunk_ib_idx].length_dw); @@ -1353,6 +1357,7 @@ int r600_cs_parse(struct radeon_cs_parser *p) } #endif kfree(p->track); + p->track = NULL; return 0; } -- 2.41.0