From owner-svn-src-head@FreeBSD.ORG Sun Aug 25 14:55:08 2013 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id A2725832; Sun, 25 Aug 2013 14:55:08 +0000 (UTC) (envelope-from dumbbell@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 8FC9721AC; Sun, 25 Aug 2013 14:55:08 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r7PEt8fX049812; Sun, 25 Aug 2013 14:55:08 GMT (envelope-from dumbbell@svn.freebsd.org) Received: (from dumbbell@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r7PEt8ao049811; Sun, 25 Aug 2013 14:55:08 GMT (envelope-from dumbbell@svn.freebsd.org) Message-Id: <201308251455.r7PEt8ao049811@svn.freebsd.org> From: Jean-Sebastien Pedron Date: Sun, 25 Aug 2013 14:55:08 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r254866 - head/sys/dev/drm2/ttm X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Aug 2013 14:55:08 -0000 Author: dumbbell Date: Sun Aug 25 14:55:08 2013 New Revision: 254866 URL: http://svnweb.freebsd.org/changeset/base/254866 Log: drm/ttm: Import Linux commit 630541863b29f88c7ab34e647758344e4cd1eafd Author: Dave Airlie Date: Wed Jan 16 14:25:44 2013 +1000 ttm: don't destroy old mm_node on memcpy failure When we are using memcpy to move objects around, and we fail to memcpy due to lack of memory to populate or failure to finish the copy, we don't want to destroy the mm_node that has been copied into old_copy. While working on a new kms driver that uses memcpy, if I overallocated bo's up to the memory limits, and eviction failed, then machine would oops soon after due to having an active bo with an already freed drm_mm embedded in it, freeing it a second time didn't end well. Reviewed-by: Jerome Glisse Signed-off-by: Dave Airlie Approved by: kib@ Modified: head/sys/dev/drm2/ttm/ttm_bo_util.c Modified: head/sys/dev/drm2/ttm/ttm_bo_util.c ============================================================================== --- head/sys/dev/drm2/ttm/ttm_bo_util.c Sun Aug 25 14:53:39 2013 (r254865) +++ head/sys/dev/drm2/ttm/ttm_bo_util.c Sun Aug 25 14:55:08 2013 (r254866) @@ -321,8 +321,12 @@ int ttm_bo_move_memcpy(struct ttm_buffer if (ttm->state == tt_unpopulated) { ret = ttm->bdev->driver->ttm_tt_populate(ttm); - if (ret) + if (ret) { + /* if we fail here don't nuke the mm node + * as the bo still owns it */ + old_copy.mm_node = NULL; goto out1; + } } add = 0; @@ -346,8 +350,11 @@ int ttm_bo_move_memcpy(struct ttm_buffer prot); } else ret = ttm_copy_io_page(new_iomap, old_iomap, page); - if (ret) + if (ret) { + /* failing here, means keep old copy as-is */ + old_copy.mm_node = NULL; goto out1; + } } mb(); out2: