diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-02-12 18:23:48 +0300 |
|---|---|---|
| committer | Maxime Ripard <mripard@kernel.org> | 2025-02-13 09:50:20 +0100 |
| commit | ff3881cc6a588f8cd714c9ffbbcc9ef6b02c8d0f (patch) | |
| tree | d8ecbdbc37f51b7eafc7f35391658bed351b3232 | |
| parent | e5f5f7ccae5fd5807587f8075e06eb8a9fca2b41 (diff) | |
drm: writeback: Fix use after free in drm_writeback_connector_cleanup()
The drm_writeback_cleanup_job() function frees "pos" so call
list_del(&pos->list_entry) first to avoid a use after free.
Fixes: 1914ba2b91ea ("drm: writeback: Create drmm variants for drm_writeback_connector initialization")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/78abd541-71e9-4b3b-a05d-2c7caf8d5b2f@stanley.mountain
Signed-off-by: Maxime Ripard <mripard@kernel.org>
| -rw-r--r-- | drivers/gpu/drm/drm_writeback.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_writeback.c b/drivers/gpu/drm/drm_writeback.c index 3628fbef7752..f139b49af4c9 100644 --- a/drivers/gpu/drm/drm_writeback.c +++ b/drivers/gpu/drm/drm_writeback.c @@ -360,8 +360,8 @@ static void drm_writeback_connector_cleanup(struct drm_device *dev, spin_lock_irqsave(&wb_connector->job_lock, flags); list_for_each_entry_safe(pos, n, &wb_connector->job_queue, list_entry) { - drm_writeback_cleanup_job(pos); list_del(&pos->list_entry); + drm_writeback_cleanup_job(pos); } spin_unlock_irqrestore(&wb_connector->job_lock, flags); } |