diff options
| author |   Changbin Du <changbin.du@intel.com> | 2017-01-05 13:28:05 +0800 |
|---|---|---|
| committer |   Zhenyu Wang <zhenyuw@linux.intel.com> | 2017-01-09 11:05:56 +0800 |
| commit | 2e51ef32b0d66fcd5fe45c437cf7c6aef8350746 (patch) | |
| tree | 6b4481f7f856c56136a5a9617d06a2cf3de58647 | |
| parent | drm/i915/gvt: remove duplicated definition (diff) | |
| download | linux-dev-2e51ef32b0d66fcd5fe45c437cf7c6aef8350746.tar.xz linux-dev-2e51ef32b0d66fcd5fe45c437cf7c6aef8350746.zip | |
drm/i915/gvt: fix use after free for workload
In the function workload_thread(), we invoke complete_current_workload()
to cleanup the just processed workload (workload will be freed there).
So we cannot access workload->req after that. This patch move
complete_current_workload() afterward.
Signed-off-by: Changbin Du <changbin.du@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/scheduler.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c index 4db242250235..c694dd039f3b 100644 --- a/drivers/gpu/drm/i915/gvt/scheduler.c +++ b/drivers/gpu/drm/i915/gvt/scheduler.c @@ -459,11 +459,11 @@ complete: gvt_dbg_sched("will complete workload %p\n, status: %d\n", workload, workload->status); - complete_current_workload(gvt, ring_id); - if (workload->req) i915_gem_request_put(fetch_and_zero(&workload->req)); + complete_current_workload(gvt, ring_id); + if (need_force_wake) intel_uncore_forcewake_put(gvt->dev_priv, FORCEWAKE_ALL); |