summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: ac168bf)
raw | patch | inline | side by side (parent: ac168bf)
author | Chris Wilson <chris@chris-wilson.co.uk> | |
Wed, 14 Dec 2011 08:20:10 +0000 (08:20 +0000) | ||
committer | Chris Wilson <chris@chris-wilson.co.uk> | |
Wed, 14 Dec 2011 08:23:02 +0000 (08:23 +0000) |
During free we unconditionally delete the bo from the vma cache. This
relies on the its list member being kept in a sane state. This fails
after the object is purged, as the purge operation performs a pure
deletion and doesn't reset the list member, leaving a pair of dangling
pointers.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
relies on the its list member being kept in a sane state. This fails
after the object is purged, as the purge operation performs a pure
deletion and doesn't reset the list member, leaving a pair of dangling
pointers.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
intel/intel_bufmgr_gem.c | patch | blob | history |
index 19441f3b7c875a00617e69ca9dd33626509f4201..eb9dd32fa1f27dd19a2c5ded4b8cc4f5aea2af53 100644 (file)
--- a/intel/intel_bufmgr_gem.c
+++ b/intel/intel_bufmgr_gem.c
bufmgr_gem->vma_cache.next,
vma_list);
assert(bo_gem->map_count == 0);
- DRMLISTDEL(&bo_gem->vma_list);
+ DRMLISTDELINIT(&bo_gem->vma_list);
if (bo_gem->mem_virtual) {
munmap(bo_gem->mem_virtual, bo_gem->bo.size);