On Mon, Oct 15, 2012 at 2:21 AM, Egbert Eich <e...@suse.de> wrote:
> radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[]
> to destroy each of them.
> radeon_ext_tmds_enc_destroy() however also has code to destroy it's
> associated I2C bus rec which has been obtained by radeon_i2c_lookup()
> and is therefore also in the i2c_bus[] list.
> This causes a double free resulting in a kernel panic when unloading
> the radeon driver.
> Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this
> problem.
>
> Signed-off-by: Egbert Eich <e...@suse.de>
Looks good. I'll add it to my queue.
Reviewed-by: Alex Deucher <alexander.deuc...@amd.com>
> ---
> drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 5 +----
> 1 files changed, 1 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
> b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
> index 92487e6..429ce8f 100644
> --- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
> +++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
> @@ -992,10 +992,7 @@ static void radeon_ext_tmds_enc_destroy(struct
> drm_encoder *encoder)
> {
> struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
> struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
> - if (tmds) {
> - if (tmds->i2c_bus)
> - radeon_i2c_destroy(tmds->i2c_bus);
> - }
> + /* don't destroy the i2c bus record here, this will be done in
> radeon_i2c_fini */
> kfree(radeon_encoder->enc_priv);
> drm_encoder_cleanup(encoder);
> kfree(radeon_encoder);
> --
> 1.7.6.3
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
