diff options
| author | Ben Skeggs <bskeggs@redhat.com> | 2011-08-22 05:15:04 +0200 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2011-08-23 10:35:16 +0200 |
| commit | eac2095398668f989a3dd8d00be1b87850d78c01 (patch) | |
| tree | 46fb51fd804c47feaac6a9e1862a36b43984f254 /drivers | |
| parent | drm/ttm: fix ttm_bo_add_ttm(user) failure path (diff) | |
| download | linux-eac2095398668f989a3dd8d00be1b87850d78c01.tar.xz linux-eac2095398668f989a3dd8d00be1b87850d78c01.zip | |
drm/ttm: unbind ttm before destroying node in accel move cleanup
Nouveau makes the assumption that if a TTM is bound there will be a mm_node
around for it and the backwards ordering here resulted in a use-after-free
on some eviction paths.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/drm/ttm/ttm_bo_util.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c index 77dbf408c0d0..ae3c6f5dd2b7 100644 --- a/drivers/gpu/drm/ttm/ttm_bo_util.c +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c @@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo, if (ret) return ret; - ttm_bo_free_old_node(bo); if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) && (bo->ttm != NULL)) { ttm_tt_unbind(bo->ttm); ttm_tt_destroy(bo->ttm); bo->ttm = NULL; } + ttm_bo_free_old_node(bo); } else { /** * This should help pipeline ordinary buffer moves. |