diff mbox

ttm: on move memory failure don't leave a node dangling

Message ID 1358316069-22176-1-git-send-email-airlied@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Dave Airlie Jan. 16, 2013, 6:01 a.m. UTC 
if we have a move notify callback, when moving fails, we call move notify
the opposite way around, however this ends up with *mem containing the mm_node
from the bo, which means we double free it. This is a follow on to the previous
fix.

Signed-off-by: Dave Airlie <airlied@redhat.com>
---
 drivers/gpu/drm/ttm/ttm_bo.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Jerome Glisse Jan. 16, 2013, 4:02 p.m. UTC | #1 
On Wed, Jan 16, 2013 at 1:01 AM, Dave Airlie <airlied@gmail.com> wrote:
> if we have a move notify callback, when moving fails, we call move notify
> the opposite way around, however this ends up with *mem containing the mm_node
> from the bo, which means we double free it. This is a follow on to the previous
> fix.
>
> Signed-off-by: Dave Airlie <airlied@redhat.com>

Reviewed-by: Jerome Glisse <jglisse@redhat.com>

> ---
>  drivers/gpu/drm/ttm/ttm_bo.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index cd64ead..076024e 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -434,6 +434,7 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
>                         bo->mem = tmp_mem;
>                         bdev->driver->move_notify(bo, mem);
>                         bo->mem = *mem;
> +                       *mem = tmp_mem;
>                 }
>
>                 goto out_err;
> --
> 1.8.1
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
diff mbox

Patch

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index cd64ead..076024e 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -434,6 +434,7 @@  static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 			bo->mem = tmp_mem;
 			bdev->driver->move_notify(bo, mem);
 			bo->mem = *mem;
+			*mem = tmp_mem;
 		}
 
 		goto out_err;