From: Nick Hoath Date: Thu, 19 Feb 2015 16:30:47 +0000 (+0000) Subject: drm/i915: Fix a use after free, and unbalanced refcounting X-Git-Tag: fixes-v4.0-rc2~24^2~1^2~4 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b3a38998f042b862f5ba4d7f2268f3a8dfb4883a;p=pandora-kernel.git drm/i915: Fix a use after free, and unbalanced refcounting When converting from implicitly tracked execlist queue items to ref counted requests, not all frees of requests were replaced with unrefs, and extraneous refs/unrefs of contexts were added. Correct the unbalanced refcount & replace the frees. Remove a noisy warning when hitting the request creation path. drm_i915_gem_request and intel_context are both kref reference counted structures. Upon allocation, drm_i915_gem_request's ref count should be bumped using kref_init. When a context is assigned to the request, the context's reference count should be bumped using i915_gem_context_reference. i915_gem_request_reference will reduce the context reference count when the request is freed. Problem introduced in commit 6d3d8274bc45de4babb62d64562d92af984dd238 Author: Nick Hoath AuthorDate: Thu Jan 15 13:10:39 2015 +0000 drm/i915: Subsume intel_ctx_submit_request in to drm_i915_gem_request v2: Added comments explaining how the ctx pointer and the request object should be ref-counted. Removed noisy warning. v3: Cleaned up the language used in the commit & the header description (Thanks David Gordon) Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88652 Signed-off-by: Nick Hoath Reviewed-by: Thomas Daniel Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula --- Reading git-diff-tree failed