summaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/ttm
diff options
context:
space:
mode:
authorDave Airlie <airlied@redhat.com>2011-02-23 14:24:01 +1000
committerDave Airlie <airlied@redhat.com>2011-02-23 14:24:01 +1000
commita2c06ee2fe5b48a71e697bae00c6e7195fc016b6 (patch)
treeff1761280d173d8adc0a7e0339dc68fd44146c08 /drivers/gpu/drm/ttm
parent63871f89d158e3f3e469dde00dd15763d474cb3c (diff)
downloadop-kernel-dev-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.zip
op-kernel-dev-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.tar.gz
Revert "ttm: Include the 'struct dev' when using the DMA API."
This reverts commit 5a893fc28f0393adb7c885a871b8c59e623fd528. This causes a use after free in the ttm free alloc pages path, when it tries to get the be after the be has been destroyed. Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/ttm')
-rw-r--r--drivers/gpu/drm/ttm/ttm_page_alloc.c11
-rw-r--r--drivers/gpu/drm/ttm/ttm_tt.c4
2 files changed, 7 insertions, 8 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 35849db..737a2a2e 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -664,7 +664,7 @@ out:
*/
int ttm_get_pages(struct list_head *pages, int flags,
enum ttm_caching_state cstate, unsigned count,
- dma_addr_t *dma_address, struct device *dev)
+ dma_addr_t *dma_address)
{
struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
struct page *p = NULL;
@@ -685,7 +685,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
for (r = 0; r < count; ++r) {
if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) {
void *addr;
- addr = dma_alloc_coherent(dev, PAGE_SIZE,
+ addr = dma_alloc_coherent(NULL, PAGE_SIZE,
&dma_address[r],
gfp_flags);
if (addr == NULL)
@@ -730,7 +730,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
printk(KERN_ERR TTM_PFX
"Failed to allocate extra pages "
"for large request.");
- ttm_put_pages(pages, 0, flags, cstate, NULL, NULL);
+ ttm_put_pages(pages, 0, flags, cstate, NULL);
return r;
}
}
@@ -741,8 +741,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
/* Put all pages in pages list to correct pool to wait for reuse */
void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags,
- enum ttm_caching_state cstate, dma_addr_t *dma_address,
- struct device *dev)
+ enum ttm_caching_state cstate, dma_addr_t *dma_address)
{
unsigned long irq_flags;
struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
@@ -758,7 +757,7 @@ void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags,
void *addr = page_address(p);
WARN_ON(!addr || !dma_address[r]);
if (addr)
- dma_free_coherent(dev, PAGE_SIZE,
+ dma_free_coherent(NULL, PAGE_SIZE,
addr,
dma_address[r]);
dma_address[r] = 0;
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index 0f8fc9f..86d5b17 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -110,7 +110,7 @@ static struct page *__ttm_tt_get_page(struct ttm_tt *ttm, int index)
INIT_LIST_HEAD(&h);
ret = ttm_get_pages(&h, ttm->page_flags, ttm->caching_state, 1,
- &ttm->dma_address[index], ttm->be->bdev->dev);
+ &ttm->dma_address[index]);
if (ret != 0)
return NULL;
@@ -304,7 +304,7 @@ static void ttm_tt_free_alloced_pages(struct ttm_tt *ttm)
}
}
ttm_put_pages(&h, count, ttm->page_flags, ttm->caching_state,
- ttm->dma_address, ttm->be->bdev->dev);
+ ttm->dma_address);
ttm->state = tt_unpopulated;
ttm->first_himem_page = ttm->num_pages;
ttm->last_lomem_page = -1;
OpenPOWER on IntegriCloud