diff options
| author | Thomas Hellstrom <thellstrom@vmware.com> | 2018-11-27 08:37:13 +0100 |
|---|---|---|
| committer | Thomas Hellstrom <thellstrom@vmware.com> | 2018-11-29 10:18:46 +0100 |
| commit | d31e8e77e1453c26a02f24b26d96b4660d29e1df (patch) | |
| tree | cf3aaf71879112a9fdfecc308ae2470739fd9326 /vmwgfx/vmwgfx_driver.c | |
| parent | 79d066da48dddcbdfcf41ecbe29cd96aaae2e11c (diff) | |
vmwgfx: Fix invalid memory accesses in CloseScreen
Some of the CloseScreen callbacks were referencing XA objects so move the
destruction of the XA state tracker to the end of drv_close_screen to avoid
referencing freed resources.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Diffstat (limited to 'vmwgfx/vmwgfx_driver.c')
| -rw-r--r-- | vmwgfx/vmwgfx_driver.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/vmwgfx/vmwgfx_driver.c b/vmwgfx/vmwgfx_driver.c index ccddb6f..e5f0caf 100644 --- a/vmwgfx/vmwgfx_driver.c +++ b/vmwgfx/vmwgfx_driver.c @@ -1314,6 +1314,7 @@ drv_close_screen(CLOSE_SCREEN_ARGS_DECL) { ScrnInfoPtr pScrn = xf86ScreenToScrn(pScreen); modesettingPtr ms = modesettingPTR(pScrn); + Bool ret; if (ms->cursor) { FreeCursor(ms->cursor, None); @@ -1339,10 +1340,12 @@ drv_close_screen(CLOSE_SCREEN_ARGS_DECL) vmwgfx_unwrap(ms, pScreen, BlockHandler); vmwgfx_unwrap(ms, pScreen, CreateScreenResources); + ret = (*pScreen->CloseScreen) (CLOSE_SCREEN_ARGS); + if (ms->xat) xa_tracker_destroy(ms->xat); - return (*pScreen->CloseScreen) (CLOSE_SCREEN_ARGS); + return ret; } static ModeStatus |