[src/trunk]: src/sys/external/bsd/drm2/drm Release the magic before releasing...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/214cdd83034d
branches:  trunk
changeset: 992952:214cdd83034d
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Mon Aug 27 14:15:12 2018 +0000

description:
Release the magic before releasing the master.

Releasing the master frees the idr into which we are trying to
release the magic.  Use of magic that has been freed sounds like a
dangerous proposition.

diffstat:

 sys/external/bsd/drm2/drm/drm_fops.c |  16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

diffs (44 lines):

diff -r 237a00e0f6f0 -r 214cdd83034d sys/external/bsd/drm2/drm/drm_fops.c
--- a/sys/external/bsd/drm2/drm/drm_fops.c      Mon Aug 27 14:14:54 2018 +0000
+++ b/sys/external/bsd/drm2/drm/drm_fops.c      Mon Aug 27 14:15:12 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: drm_fops.c,v 1.10 2018/08/27 07:53:52 riastradh Exp $  */
+/*     $NetBSD: drm_fops.c,v 1.11 2018/08/27 14:15:12 riastradh Exp $  */
 
 /*-
  * Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: drm_fops.c,v 1.10 2018/08/27 07:53:52 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: drm_fops.c,v 1.11 2018/08/27 14:15:12 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/select.h>
@@ -214,6 +214,12 @@
        struct drm_minor *const minor = file->minor;
        struct drm_device *const dev = minor->dev;
 
+       mutex_lock(&dev->struct_mutex);
+       list_del(&file->lhead);
+       if (file->magic)
+               idr_remove(&file->master->magic_map, file->magic);
+       mutex_unlock(&dev->struct_mutex);
+
        if (dev->driver->preclose)
                (*dev->driver->preclose)(dev, file);
 
@@ -229,12 +235,6 @@
        drm_legacy_ctxbitmap_flush(dev, file);
        drm_close_file_master(file);
 
-       mutex_lock(&dev->struct_mutex);
-       list_del(&file->lhead);
-       if (file->magic)
-               idr_remove(&file->master->magic_map, file->magic);
-       mutex_unlock(&dev->struct_mutex);
-
        if (dev->driver->postclose)
                (*dev->driver->postclose)(dev, file);
 #ifndef __NetBSD__             /* XXX drm prime */