diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2009-02-09 11:31:41 +0000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2009-02-20 12:21:08 +1000 |
| commit | ad45aa9e6e010283bbd8cf0c6309866233e113f2 (patch) | |
| tree | 445135f1c9a8e270e6d350404d6ecf57b8f778ef | |
| parent | 005568be363b90c9333c3bcbc1e7a53922816322 (diff) | |
drm: Potential use-after-free on error path.
Remove the member from the hash table before we free the structure!
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
| -rw-r--r-- | drivers/gpu/drm/drm_gem.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 6915fb82d0b0..308fe1e207f5 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -104,8 +104,8 @@ drm_gem_init(struct drm_device *dev) if (drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START, DRM_FILE_PAGE_OFFSET_SIZE)) { - drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM); drm_ht_remove(&mm->offset_hash); + drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM); return -ENOMEM; } |