evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

drm/ttm: unbind ttm before destroying node in accel move cleanup

Browse source 
Nouveau makes the assumption that if a TTM is bound there will be a mm_node
around for it and the backwards ordering here resulted in a use-after-free
on some eviction paths.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Ben Skeggs 2011-08-22 03:15:04 +00:00 • committed by Dave Airlie
parent 7c4c3960df
commit eac2095398
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/gpu/drm/ttm/ttm_bo_util.c
View file

@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
if (ret) if (ret)
return ret; return ret;
ttm_bo_free_old_node(bo);
if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) && if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
(bo->ttm != NULL)) { (bo->ttm != NULL)) {
ttm_tt_unbind(bo->ttm); ttm_tt_unbind(bo->ttm);
ttm_tt_destroy(bo->ttm); ttm_tt_destroy(bo->ttm);
bo->ttm = NULL; bo->ttm = NULL;
} }
ttm_bo_free_old_node(bo);
} else { } else {
/** /**
* This should help pipeline ordinary buffer moves. * This should help pipeline ordinary buffer moves.