Commit 6ccb81f2 authored Nov 08, 2014 by Alexey Khoroshilov Committed by Daniel Vetter Nov 14, 2014

drm/i915: avoid deadlock on failure paths in __intel_framebuffer_create()



Since a8bb6818 __intel_framebuffer_create() is called
with struct_mutex held, so it should use drm_gem_object_unreference()
instead of drm_gem_object_unreference_unlocked().

Found by Linux Driver Verification project (linuxtesting.org).

This regression has been introduced in

commit a8bb6818
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Mon Feb 10 18:00:39 2014 +0100

    drm/i915: Fix error path leak in fbdev fb allocation

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

parent e1f234bd

drivers/gpu/drm/i915/intel_display.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -8421,7 +8421,7 @@ __intel_framebuffer_create(struct drm_device *dev,

		intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
		if (!intel_fb) {
		drm_gem_object_unreference_unlocked(&obj->base);
		drm_gem_object_unreference(&obj->base);
		return ERR_PTR(-ENOMEM);
		}

		@@ -8431,7 +8431,7 @@ __intel_framebuffer_create(struct drm_device *dev,

		return &intel_fb->base;
		err:
		drm_gem_object_unreference_unlocked(&obj->base);
		drm_gem_object_unreference(&obj->base);
		kfree(intel_fb);

		return ERR_PTR(ret);