diff options
| author | Dan Carpenter <[email protected]> | 2025-02-12 15:23:48 +0000 |
|---|---|---|
| committer | Maxime Ripard <[email protected]> | 2025-02-13 08:50:20 +0000 |
| commit | ff3881cc6a588f8cd714c9ffbbcc9ef6b02c8d0f (patch) | |
| tree | d8ecbdbc37f51b7eafc7f35391658bed351b3232 | |
| parent | drm/tests: Fix a test in drm_test_check_valid_clones() (diff) | |
| download | kernel-ff3881cc6a588f8cd714c9ffbbcc9ef6b02c8d0f.tar.gz kernel-ff3881cc6a588f8cd714c9ffbbcc9ef6b02c8d0f.zip | |
drm: writeback: Fix use after free in drm_writeback_connector_cleanup()
The drm_writeback_cleanup_job() function frees "pos" so call
list_del(&pos->list_entry) first to avoid a use after free.
Fixes: 1914ba2b91ea ("drm: writeback: Create drmm variants for drm_writeback_connector initialization")
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Dmitry Baryshkov <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Maxime Ripard <[email protected]>
| -rw-r--r-- | drivers/gpu/drm/drm_writeback.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_writeback.c b/drivers/gpu/drm/drm_writeback.c index 3628fbef7752..f139b49af4c9 100644 --- a/drivers/gpu/drm/drm_writeback.c +++ b/drivers/gpu/drm/drm_writeback.c @@ -360,8 +360,8 @@ static void drm_writeback_connector_cleanup(struct drm_device *dev, spin_lock_irqsave(&wb_connector->job_lock, flags); list_for_each_entry_safe(pos, n, &wb_connector->job_queue, list_entry) { - drm_writeback_cleanup_job(pos); list_del(&pos->list_entry); + drm_writeback_cleanup_job(pos); } spin_unlock_irqrestore(&wb_connector->job_lock, flags); } |