summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorFrediano Ziglio <fziglio@redhat.com>2015-06-03 12:09:12 +0100
committerDave Airlie <airlied@redhat.com>2015-06-05 11:00:49 +1000
commitfe2af53baec1b3b64ee343d4e7e6a351e52e3b48 (patch)
tree66242c3026421d0b535440d8be0b9ef98a6d734c /drivers
parent55cc3df08a2c6a9c9c20b34ba26de0512a750b5e (diff)
downloadkernel-fe2af53baec1b3b64ee343d4e7e6a351e52e3b48.tar.gz
drm/qxl: Avoid double free on error
Is we are not able to get source bo object from handle we free destination bo object and call cleanup code however destination object was already inserted in reloc_info array (num_relocs was already incremented) so on cleanup we free destination again. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/gpu/drm/qxl/qxl_ioctl.c2
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 9bf1368bc92c..77fcde6f3465 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -240,8 +240,6 @@ static int qxl_process_single_command(struct qxl_device *qdev,
qxlhw_handle_to_bo(qdev, file_priv,
reloc.src_handle, release);
if (!reloc_info[i].src_bo) {
- if (reloc_info[i].dst_bo != cmd_bo)
- drm_gem_object_unreference_unlocked(&reloc_info[i].dst_bo->gem_base);
ret = -EINVAL;
goto out_free_bos;
}