From 48ae1c909b4c6e8a7d36f53d6f0900799dd108b0 Mon Sep 17 00:00:00 2001 From: jimqu Date: Mon, 28 Nov 2016 08:05:46 +0800 Subject: [PATCH 0026/4131] drm/amd/display: Fix memory corruption issue. temp_flip_context is always same as current_context, and the current_context will be freed in dc_commit_targets(), but temp_flip_context will be used in dc_update_surfaces_for_target(). Signed-off-by: JimQu Reviewed-by: Andrey Grodzovsky Acked-by: Harry Wentland Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index f7638f8..424a7d4 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1096,8 +1096,12 @@ bool dc_commit_targets( resource_validate_ctx_destruct(core_dc->current_context); - dm_free(core_dc->current_context); + if (core_dc->temp_flip_context != core_dc->current_context) { + dm_free(core_dc->temp_flip_context); + core_dc->temp_flip_context = core_dc->current_context; + } core_dc->current_context = context; + memset(core_dc->temp_flip_context, 0, sizeof(*core_dc->temp_flip_context)); return (result == DC_OK); -- 2.7.4