diff mbox

Fix SIGSEGV in libdrm for heigth = 0 and width = 0

Message ID 1415385784.6136.7.camel@localhost.localdomain (mailing list archive)
State New, archived
Headers show

Commit Message

Thomas Meyer Nov. 7, 2014, 6:43 p.m. UTC 
drm_intel_gem_bo_free() crashes because the list bo_gem->vma_list is not
yet initialised, but the error path tries to free it.

See also https://bugs.freedesktop.org/show_bug.cgi?id=75844

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
---

Comments

Lespiau, Damien Nov. 20, 2014, 2:12 p.m. UTC | #1 
On Fri, Nov 07, 2014 at 07:43:04PM +0100, Thomas Meyer wrote:
> 
> drm_intel_gem_bo_free() crashes because the list bo_gem->vma_list is not
> yet initialised, but the error path tries to free it.
> 
> See also https://bugs.freedesktop.org/show_bug.cgi?id=75844
> 
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Thomas Meyer <thomas@m3y3r.de>

Thanks for the patch and review tag. Sorry it took so long to push, it
wasn't clear who was going to do it.
diff mbox

Patch

diff --git a/intel/intel_bufmgr_gem.c b/intel/intel_bufmgr_gem.c
index f2f4fea..b3e9dba 100644
--- a/intel/intel_bufmgr_gem.c
+++ b/intel/intel_bufmgr_gem.c
@@ -759,15 +759,16 @@  retry:
 		bo_gem->swizzle_mode = I915_BIT_6_SWIZZLE_NONE;
 		bo_gem->stride = 0;
 
+		/* drm_intel_gem_bo_free calls DRMLISTDEL() for an uninitialized
+		   list (vma_list), so better set the list head here */
+		DRMINITLISTHEAD(&bo_gem->name_list);
+		DRMINITLISTHEAD(&bo_gem->vma_list);
 		if (drm_intel_gem_bo_set_tiling_internal(&bo_gem->bo,
 							 tiling_mode,
 							 stride)) {
 		    drm_intel_gem_bo_free(&bo_gem->bo);
 		    return NULL;
 		}
-
-		DRMINITLISTHEAD(&bo_gem->name_list);
-		DRMINITLISTHEAD(&bo_gem->vma_list);
 	}
 
 	bo_gem->name = name;