diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2017-03-08 21:00:59 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2017-03-08 21:03:22 +0000 |
| commit | 19c4cfc54918d361f2535aec16650e9f0be667cd (patch) | |
| tree | b7b54203646ce735728001d4d423a47990ba2440 /intel | |
| parent | 5ee9cb4b4b6964bcd463b0490f3027e6ccfbf45a (diff) | |
| download | libdrm-19c4cfc54918d361f2535aec16650e9f0be667cd.tar.gz libdrm-19c4cfc54918d361f2535aec16650e9f0be667cd.tar.bz2 libdrm-19c4cfc54918d361f2535aec16650e9f0be667cd.zip | |
intel: Add handle to hashtable before freeing along an error path
drm_intel_gem_bo_free() unconditionally attempts to remove the handle
from the hashtable. This goes horribly wrong if we haven't already added
the bo to the hashtable.
Reported-by: Michael Thayer <michael.thayer@oracle.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Diffstat (limited to 'intel')
| -rw-r--r-- | intel/intel_bufmgr_gem.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/intel/intel_bufmgr_gem.c b/intel/intel_bufmgr_gem.c index b1e69070..e260f2dc 100644 --- a/intel/intel_bufmgr_gem.c +++ b/intel/intel_bufmgr_gem.c @@ -815,6 +815,10 @@ retry: } bo_gem->gem_handle = create.handle; + HASH_ADD(handle_hh, bufmgr_gem->handle_table, + gem_handle, sizeof(bo_gem->gem_handle), + bo_gem); + bo_gem->bo.handle = bo_gem->gem_handle; bo_gem->bo.bufmgr = bufmgr; bo_gem->bo.align = alignment; @@ -827,10 +831,6 @@ retry: tiling_mode, stride)) goto err_free; - - HASH_ADD(handle_hh, bufmgr_gem->handle_table, - gem_handle, sizeof(bo_gem->gem_handle), - bo_gem); } bo_gem->name = name; |