From patchwork Mon Aug 22 03:15:04 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Skeggs X-Patchwork-Id: 1084282 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter1.kernel.org (8.14.4/8.14.4) with ESMTP id p7M3BSfN025606 for ; Mon, 22 Aug 2011 03:11:49 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 008E49ED55 for ; Sun, 21 Aug 2011 20:11:28 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-vw0-f49.google.com (mail-vw0-f49.google.com [209.85.212.49]) by gabe.freedesktop.org (Postfix) with ESMTP id C298A9E77E for ; Sun, 21 Aug 2011 20:11:18 -0700 (PDT) Received: by vws8 with SMTP id 8so4423649vws.36 for ; Sun, 21 Aug 2011 20:11:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; bh=vEkEYJqlz1HL+qj5xc22G/fcQ/paocuOXfD1BoCSq8k=; b=O+pjAoG8QBIDpdkRSxUGskhKzBfKxtYlVmF3Zuo8JY+hsqZcdc3ai3+rjAJTkI2gYW JRHDyJuXoy8koH/9xYqduy8WIqFKD0QL4bcJNlyp9MQAXu/EUFpFJPSlMS2uddHbO1el V7zvpUyeXtfgY4xaQ0hRqsHdmzZWfbKfRd0SQ= Received: by 10.220.188.71 with SMTP id cz7mr546228vcb.65.1313982677875; Sun, 21 Aug 2011 20:11:17 -0700 (PDT) Received: from pegasus.bne.redhat.com ([66.187.239.10]) by mx.google.com with ESMTPS id n5sm2808326vcw.32.2011.08.21.20.11.15 (version=SSLv3 cipher=OTHER); Sun, 21 Aug 2011 20:11:17 -0700 (PDT) From: skeggsb@gmail.com To: dri-devel@lists.freedesktop.org Subject: [PATCH 1/2] drm/ttm: unbind ttm before destroying node in accel move cleanup Date: Mon, 22 Aug 2011 13:15:04 +1000 Message-Id: <1313982905-30129-1-git-send-email-skeggsb@gmail.com> X-Mailer: git-send-email 1.7.6 Cc: Ben Skeggs X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Mon, 22 Aug 2011 03:11:49 +0000 (UTC) From: Ben Skeggs Nouveau makes the assumption that if a TTM is bound there will be a mm_node around for it and the backwards ordering here resulted in a use-after-free on some eviction paths. Signed-off-by: Ben Skeggs Reviewed-by: Jerome Glisse --- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c index 77dbf40..ae3c6f5 100644 --- a/drivers/gpu/drm/ttm/ttm_bo_util.c +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c @@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo, if (ret) return ret; - ttm_bo_free_old_node(bo); if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) && (bo->ttm != NULL)) { ttm_tt_unbind(bo->ttm); ttm_tt_destroy(bo->ttm); bo->ttm = NULL; } + ttm_bo_free_old_node(bo); } else { /** * This should help pipeline ordinary buffer moves.