From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:49116 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756007AbdDRMsy (ORCPT ); Tue, 18 Apr 2017 08:48:54 -0400 Subject: Patch "drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state" has been added to the 4.10-stable tree To: bskeggs@redhat.com, gregkh@linuxfoundation.org Cc: , From: Date: Tue, 18 Apr 2017 14:48:37 +0200 Message-ID: <14925197177973@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state to the 4.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-nouveau-kms-nv50-fix-double-dma_fence_put-when-destroying-plane-state.patch and it can be found in the queue-4.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 2907e8670b6ef253bffb33bf47fd2182969cf2a0 Mon Sep 17 00:00:00 2001 From: Ben Skeggs Date: Wed, 5 Apr 2017 18:16:14 +1000 Subject: drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state From: Ben Skeggs commit 2907e8670b6ef253bffb33bf47fd2182969cf2a0 upstream. When the atomic support was added to nouveau, the DRM core did not do this. However, later in the same merge window, a commit (drm/fence: add in-fences support) was merged that added it, leading to use-after-frees of the fence object. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/nouveau/nv50_display.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/gpu/drm/nouveau/nv50_display.c +++ b/drivers/gpu/drm/nouveau/nv50_display.c @@ -995,7 +995,6 @@ nv50_wndw_atomic_destroy_state(struct dr { struct nv50_wndw_atom *asyw = nv50_wndw_atom(state); __drm_atomic_helper_plane_destroy_state(&asyw->state); - dma_fence_put(asyw->state.fence); kfree(asyw); } @@ -1007,7 +1006,6 @@ nv50_wndw_atomic_duplicate_state(struct if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL))) return NULL; __drm_atomic_helper_plane_duplicate_state(plane, &asyw->state); - asyw->state.fence = NULL; asyw->interval = 1; asyw->sema = armw->sema; asyw->ntfy = armw->ntfy; Patches currently in stable-queue which might be from bskeggs@redhat.com are queue-4.10/drm-nouveau-mpeg-mthd-returns-true-on-success-now.patch queue-4.10/drm-nouveau-mmu-nv4a-use-nv04-mmu-rather-than-the-nv44-one.patch queue-4.10/drm-nouveau-kms-nv50-fix-setting-of-headsetrastervertblankdmi-method.patch queue-4.10/drm-nouveau-kms-nv50-fix-double-dma_fence_put-when-destroying-plane-state.patch queue-4.10/drm-nouveau-initial-support-display-only-for-gp107.patch