[src/trunk]: src/sys/external/bsd/drm2/drm Release the magic before releasing...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a88bcd77d720
branches:  trunk
changeset: 366253:a88bcd77d720
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Mon Aug 27 14:15:12 2018 +0000

description:
Release the magic before releasing the master.

Releasing the master frees the idr into which we are trying to
release the magic.  Use of magic that has been freed sounds like a
dangerous proposition.

diffstat:

 sys/external/bsd/drm2/drm/drm_fops.c |  16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

diffs (44 lines):

diff -r 935d997ffb34 -r a88bcd77d720 sys/external/bsd/drm2/drm/drm_fops.c
--- a/sys/external/bsd/drm2/drm/drm_fops.c      Mon Aug 27 14:14:54 2018 +0000
+++ b/sys/external/bsd/drm2/drm/drm_fops.c      Mon Aug 27 14:15:12 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: drm_fops.c,v 1.10 2018/08/27 07:53:52 riastradh Exp $  */
+/*     $NetBSD: drm_fops.c,v 1.11 2018/08/27 14:15:12 riastradh Exp $  */
 
 /*-
  * Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: drm_fops.c,v 1.10 2018/08/27 07:53:52 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: drm_fops.c,v 1.11 2018/08/27 14:15:12 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/select.h>
@@ -214,6 +214,12 @@
        struct drm_minor *const minor = file->minor;
        struct drm_device *const dev = minor->dev;
 
+       mutex_lock(&dev->struct_mutex);
+       list_del(&file->lhead);
+       if (file->magic)
+               idr_remove(&file->master->magic_map, file->magic);
+       mutex_unlock(&dev->struct_mutex);
+
        if (dev->driver->preclose)
                (*dev->driver->preclose)(dev, file);
 
@@ -229,12 +235,6 @@
        drm_legacy_ctxbitmap_flush(dev, file);
        drm_close_file_master(file);
 
-       mutex_lock(&dev->struct_mutex);
-       list_del(&file->lhead);
-       if (file->magic)
-               idr_remove(&file->master->magic_map, file->magic);
-       mutex_unlock(&dev->struct_mutex);
-
        if (dev->driver->postclose)
                (*dev->driver->postclose)(dev, file);
 #ifndef __NetBSD__             /* XXX drm prime */