[1/1] change the order to cleanup drm_property_blob after drm_crtc

Submitted by James Xiong on April 13, 2016, 6:09 p.m.

Details

Message ID 1460570946-19126-1-git-send-email-james.xiong@intel.com
State New
Headers show
Series "Series without cover letter" ( rev: 1 ) in Intel GFX

Not browsing as part of any series.

Commit Message

James Xiong April 13, 2016, 6:09 p.m.
From: "Xiong, James" <james.xiong@intel.com>

Previously drm_mode_config_cleanup freed drm_property_blob first,
then the drm_crtc which triggered unref calls to its associated
drm_propery_blob, and could potentially cause memory corruption.

Signed-off-by: Xiong, James <james.xiong@intel.com>
---
 drivers/gpu/drm/drm_crtc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Patch hide | download patch | download mbox

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 30fea23..c93576a 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -5950,11 +5950,6 @@  void drm_mode_config_cleanup(struct drm_device *dev)
 		drm_property_destroy(dev, property);
 	}
 
-	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
-				 head_global) {
-		drm_property_unreference_blob(blob);
-	}
-
 	/*
 	 * Single-threaded teardown context, so it's not required to grab the
 	 * fb_lock to protect against concurrent fb_list access. Contrary, it
@@ -5977,6 +5972,11 @@  void drm_mode_config_cleanup(struct drm_device *dev)
 		crtc->funcs->destroy(crtc);
 	}
 
+	list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
+				head_global) {
+		drm_property_unreference_blob(blob);
+	}
+
 	ida_destroy(&dev->mode_config.connector_ida);
 	idr_destroy(&dev->mode_config.tile_idr);
 	idr_destroy(&dev->mode_config.crtc_idr);