[patch] xf86-video-intel: fix bo_list corruption

Hong Liu hong.liu at intel.com
Mon Feb 4 01:00:49 PST 2008


bo_list is corrupted when we call i830_free_3d_memory. 
This happens when the virtual size is > 2048 for non-965 machine and
it causes X server segfault because the front buffer is not binded when entering VT.

Thanks,
Hong

diff --git a/src/i830_memory.c b/src/i830_memory.c
index 5dbafee..31c8ad0 100644
--- a/src/i830_memory.c
+++ b/src/i830_memory.c
@@ -274,12 +274,16 @@ i830_free_memory(ScrnInfoPtr pScrn, i830_memory *mem)
 	I830Ptr pI830 = I830PTR(pScrn);
 
 	drmBOUnreference(pI830->drmSubFD, &mem->bo);
-	if (pI830->bo_list == mem)
+	if (pI830->bo_list == mem) {
 	    pI830->bo_list = mem->next;
-	if (mem->next)
-	    mem->next->prev = NULL;
-	if (mem->prev)
-	    mem->prev->next = NULL;
+	    if (mem->next)
+		mem->next->prev = NULL;
+	} else {
+	    if (mem->prev)
+		mem->prev->next = mem->next;
+	    if (mem->next)
+		mem->next->prev = mem->prev;
+	}
 	xfree(mem->name);
 	xfree(mem);
 	return;





More information about the xorg mailing list