diff options
| author | Jani Nikula <jani.nikula@intel.com> | 2020-02-26 22:58:24 +0200 |
|---|---|---|
| committer | Jani Nikula <jani.nikula@intel.com> | 2020-02-26 22:58:25 +0200 |
| commit | 8e9a400c706ee5bcbc052d3ec9f87cfdbbd3f5cb (patch) | |
| tree | 42af2b553702b69f7d78d3d5de10def05756e929 | |
| parent | 238734262142075056653b4de091458e0ca858f2 (diff) | |
| parent | b549c252b1292aea959cd9b83537fcb9384a6112 (diff) | |
Merge tag 'gvt-fixes-2020-02-26' of https://github.com/intel/gvt-linux into drm-intel-fixes
gvt-fixes-2020-02-26
- Fix virtual display reset (Tina)
- Fix one use-after-free for dmabuf (Tina)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
From: Zhenyu Wang <zhenyuw@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200226103016.GC10413@zhen-hp.sh.intel.com
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/dmabuf.c | 2 | ||||
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/vgpu.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c index 2477a1e5a166..ae139f0877ae 100644 --- a/drivers/gpu/drm/i915/gvt/dmabuf.c +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c @@ -151,12 +151,12 @@ static void dmabuf_gem_object_free(struct kref *kref) dmabuf_obj = container_of(pos, struct intel_vgpu_dmabuf_obj, list); if (dmabuf_obj == obj) { + list_del(pos); intel_gvt_hypervisor_put_vfio_device(vgpu); idr_remove(&vgpu->object_idr, dmabuf_obj->dmabuf_id); kfree(dmabuf_obj->info); kfree(dmabuf_obj); - list_del(pos); break; } } diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c index 85bd9bf4f6ee..487af6ea9972 100644 --- a/drivers/gpu/drm/i915/gvt/vgpu.c +++ b/drivers/gpu/drm/i915/gvt/vgpu.c @@ -560,9 +560,9 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr, intel_vgpu_reset_mmio(vgpu, dmlr); populate_pvinfo_page(vgpu); - intel_vgpu_reset_display(vgpu); if (dmlr) { + intel_vgpu_reset_display(vgpu); intel_vgpu_reset_cfg_space(vgpu); /* only reset the failsafe mode when dmlr reset */ vgpu->failsafe = false; |