From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965317AbcA1JHO (ORCPT ); Thu, 28 Jan 2016 04:07:14 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:43248 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753197AbcA1JHI (ORCPT ); Thu, 28 Jan 2016 04:07:08 -0500 Date: Thu, 28 Jan 2016 12:06:46 +0300 From: Dan Carpenter To: David Airlie , Daniel Vetter Cc: Thomas Hellstrom , Alex Deucher , Daniel Stone , Sinclair Yeh , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] drm/vmwgfx: fix a NULL dereference Message-ID: <20160128090646.GA5824@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We dereference "eaction->event" inside the call to drm_send_event_locked() so should hold off on setting it to NULL until afterward. Fixes: fb740cf2492c ("drm: Create drm_send_event helpers") Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index e0edf14..37c305b 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -880,8 +880,8 @@ static void vmw_event_fence_action_seq_passed(struct vmw_fence_action *action) } list_del_init(&eaction->fpriv_head); - eaction->event = NULL; drm_send_event_locked(dev, eaction->event); + eaction->event = NULL; spin_unlock_irqrestore(&dev->event_lock, irq_flags); }