DragonFlyBSD Kernel Audit
DF-1657 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/radeon/radeon_uvd.c
+++ b/sys/dev/drm/radeon/radeon_uvd.c
@@ -555,7 +555,8 @@
 	case 2:
 		/* it's a destroy msg, free the handle */
 		for (i = 0; i < p->rdev->uvd.max_handles; ++i)
-			atomic_cmpxchg(&p->rdev->uvd.handles[i], handle, 0);
+			if (p->rdev->uvd.filp[i] == p->filp)
+				atomic_cmpxchg(&p->rdev->uvd.handles[i], handle, 0);
 		radeon_bo_kunmap(bo);
 		return 0;