From 6366d75f37ed6a6e675bfde774b458db8ec1fd0a Mon Sep 17 00:00:00 2001 From: jsg Date: Fri, 10 Feb 2023 14:39:13 +0000 Subject: [PATCH] drm/i915: Fix potential bit_17 double-free From Rob Clark 0769f997a7b6d5cb8336db0b4ec3d2d311b8097c in linux-6.1.y/6.1.11 7057a8f126f14f14b040faecfa220fd27c6c2f85 in mainline linux --- sys/dev/pci/drm/i915/gem/i915_gem_tiling.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c b/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c index 023f34ee7ae..b25cd2ba2a1 100644 --- a/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c +++ b/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c @@ -305,10 +305,6 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, spin_unlock(&obj->vma.lock); obj->tiling_and_stride = tiling | stride; - i915_gem_object_unlock(obj); - - /* Force the fence to be reacquired for GTT access */ - i915_gem_object_release_mmap_gtt(obj); /* Try to preallocate memory required to save swizzling on put-pages */ if (i915_gem_object_needs_bit17_swizzle(obj)) { @@ -321,6 +317,11 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, obj->bit_17 = NULL; } + i915_gem_object_unlock(obj); + + /* Force the fence to be reacquired for GTT access */ + i915_gem_object_release_mmap_gtt(obj); + return 0; } -- 2.20.1