summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorDave Airlie <airlied@redhat.com>2019-01-04 07:09:12 +0300
committerDave Airlie <airlied@redhat.com>2019-01-04 07:09:15 +0300
commit9ddf32a8df9e342371aaf9233d59739a356231e6 (patch)
treebb1673a277628d7281c47dfbfc0418ebb232c905 /drivers
parent74136a3d47f51ae72ee8b9ebc1ec2a29bcf30676 (diff)
parentc75ff001f4fe21a8c9f15aad799a8949aea109f7 (diff)
downloadlinux-9ddf32a8df9e342371aaf9233d59739a356231e6.tar.xz
Merge tag 'drm-misc-next-fixes-2019-01-02' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
Fixes for v4.21: - Fix null pointer dereference on null state pointer. - Fix leaking damage clip when destroying plane state. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/46c4dbcd-dc23-7b46-fda9-16fe33e6ceef@linux.intel.com
Diffstat (limited to 'drivers')
-rw-r--r--drivers/gpu/drm/drm_atomic_state_helper.c3
-rw-r--r--drivers/gpu/drm/drm_damage_helper.c3
2 files changed, 5 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_atomic_state_helper.c b/drivers/gpu/drm/drm_atomic_state_helper.c
index 60bd7d708e35..4985384e51f6 100644
--- a/drivers/gpu/drm/drm_atomic_state_helper.c
+++ b/drivers/gpu/drm/drm_atomic_state_helper.c
@@ -241,6 +241,7 @@ void __drm_atomic_helper_plane_duplicate_state(struct drm_plane *plane,
state->fence = NULL;
state->commit = NULL;
+ state->fb_damage_clips = NULL;
}
EXPORT_SYMBOL(__drm_atomic_helper_plane_duplicate_state);
@@ -285,6 +286,8 @@ void __drm_atomic_helper_plane_destroy_state(struct drm_plane_state *state)
if (state->commit)
drm_crtc_commit_put(state->commit);
+
+ drm_property_blob_put(state->fb_damage_clips);
}
EXPORT_SYMBOL(__drm_atomic_helper_plane_destroy_state);
diff --git a/drivers/gpu/drm/drm_damage_helper.c b/drivers/gpu/drm/drm_damage_helper.c
index d2a1c7372f36..31032407254d 100644
--- a/drivers/gpu/drm/drm_damage_helper.c
+++ b/drivers/gpu/drm/drm_damage_helper.c
@@ -178,7 +178,7 @@ int drm_atomic_helper_dirtyfb(struct drm_framebuffer *fb,
state = drm_atomic_state_alloc(fb->dev);
if (!state) {
ret = -ENOMEM;
- goto out;
+ goto out_drop_locks;
}
state->acquire_ctx = &ctx;
@@ -238,6 +238,7 @@ out:
kfree(rects);
drm_atomic_state_put(state);
+out_drop_locks:
drm_modeset_drop_locks(&ctx);
drm_modeset_acquire_fini(&ctx);