diff options
| author | Ben Skeggs <bskeggs@redhat.com> | 2009-03-06 08:51:04 +1000 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2009-03-06 09:09:08 +1000 |
| commit | 7946b7615fbfaffbb40914db94e094bca7325541 (patch) | |
| tree | 580cdc5c00bbbd3f9500af65b814eddd9162f3d9 | |
| parent | c921f402b743e12e19e0816bde7917953352d921 (diff) | |
nouveau: fix oops in gem_new() failure path
It turns out drm_bo_usage_deref_locked doesn't set the pointer it's passed
to NULL after destroying the object. So, this double free made things go
boom!
| -rw-r--r-- | linux-core/nouveau_gem.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/linux-core/nouveau_gem.c b/linux-core/nouveau_gem.c index d290f26e..62d68a12 100644 --- a/linux-core/nouveau_gem.c +++ b/linux-core/nouveau_gem.c @@ -114,8 +114,6 @@ nouveau_gem_new(struct drm_device *dev, struct nouveau_channel *chan, out: if (ret) { mutex_lock(&dev->struct_mutex); - if (ngem->bo) - drm_bo_usage_deref_locked(&ngem->bo); drm_gem_object_unreference(gem); mutex_unlock(&dev->struct_mutex); return ret; |