drm/i915: Fix use after free within tracepoint
authorChris Wilson <chris@chris-wilson.co.uk>
Sun, 20 Mar 2011 11:20:19 +0000 (11:20 +0000)
committerChris Wilson <chris@chris-wilson.co.uk>
Wed, 23 Mar 2011 09:17:02 +0000 (09:17 +0000)
Detected by scripts/coccinelle/free/kfree.cocci.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Keith Packard <keithp@keithp.com>
drivers/gpu/drm/i915/i915_gem.c

index edd6098743b295613b431fe5d6673fe9b1a0c97f..c9bdaf208a91f9e2023d621107716ac77b68fb1c 100644 (file)
@@ -3603,6 +3603,8 @@ static void i915_gem_free_object_tail(struct drm_i915_gem_object *obj)
                return;
        }
 
+       trace_i915_gem_object_destroy(obj);
+
        if (obj->base.map_list.map)
                i915_gem_free_mmap_offset(obj);
 
@@ -3612,8 +3614,6 @@ static void i915_gem_free_object_tail(struct drm_i915_gem_object *obj)
        kfree(obj->page_cpu_valid);
        kfree(obj->bit_17);
        kfree(obj);
-
-       trace_i915_gem_object_destroy(obj);
 }
 
 void i915_gem_free_object(struct drm_gem_object *gem_obj)