diff options
author | Dave Airlie <airlied@gmail.com> | 2013-01-16 15:58:34 +1000 |
---|---|---|
committer | Dave Airlie <airlied@redhat.com> | 2013-01-21 13:45:23 +1000 |
commit | 014b34409fb2015f63663b6cafdf557fdf289628 (patch) | |
tree | fd30b4512a1f2a992c03bcf808ead98f4d1b21fa | |
parent | 630541863b29f88c7ab34e647758344e4cd1eafd (diff) | |
download | op-kernel-dev-014b34409fb2015f63663b6cafdf557fdf289628.zip op-kernel-dev-014b34409fb2015f63663b6cafdf557fdf289628.tar.gz |
ttm: on move memory failure don't leave a node dangling
if we have a move notify callback, when moving fails, we call move notify
the opposite way around, however this ends up with *mem containing the mm_node
from the bo, which means we double free it. This is a follow on to the previous
fix.
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
-rw-r--r-- | drivers/gpu/drm/ttm/ttm_bo.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 33d20be..52b20b1 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -434,6 +434,7 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo, bo->mem = tmp_mem; bdev->driver->move_notify(bo, mem); bo->mem = *mem; + *mem = tmp_mem; } goto out_err; |