From: jimqu Date: Mon, 28 Nov 2016 00:05:46 +0000 (+0800) Subject: drm/amd/display: Fix memory corruption issue. X-Git-Tag: v4.15~362^2~23^2~891 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=ead964f24e111aa5ba6ec4c2ee15ae20f11a121a;p=mirror_ubuntu-bionic-kernel.git drm/amd/display: Fix memory corruption issue. temp_flip_context is always same as current_context, and the current_context will be freed in dc_commit_targets(), but temp_flip_context will be used in dc_update_surfaces_for_target(). Signed-off-by: JimQu Reviewed-by: Andrey Grodzovsky Acked-by: Harry Wentland Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index f7638f84421b..424a7d4b8731 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1096,8 +1096,12 @@ bool dc_commit_targets( resource_validate_ctx_destruct(core_dc->current_context); - dm_free(core_dc->current_context); + if (core_dc->temp_flip_context != core_dc->current_context) { + dm_free(core_dc->temp_flip_context); + core_dc->temp_flip_context = core_dc->current_context; + } core_dc->current_context = context; + memset(core_dc->temp_flip_context, 0, sizeof(*core_dc->temp_flip_context)); return (result == DC_OK);