Date: Sun, 25 Aug 2013 14:56:14 +0000 (UTC) From: Jean-Sebastien Pedron <dumbbell@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r254867 - head/sys/dev/drm2/ttm Message-ID: <201308251456.r7PEuEF1049983@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: dumbbell Date: Sun Aug 25 14:56:14 2013 New Revision: 254867 URL: http://svnweb.freebsd.org/changeset/base/254867 Log: drm/ttm: Import Linux commit 014b34409fb2015f63663b6cafdf557fdf289628 Author: Dave Airlie <airlied@gmail.com> Date: Wed Jan 16 15:58:34 2013 +1000 ttm: on move memory failure don't leave a node dangling if we have a move notify callback, when moving fails, we call move notify the opposite way around, however this ends up with *mem containing the mm_node from the bo, which means we double free it. This is a follow on to the previous fix. Reviewed-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Approved by: kib@ Modified: head/sys/dev/drm2/ttm/ttm_bo.c Modified: head/sys/dev/drm2/ttm/ttm_bo.c ============================================================================== --- head/sys/dev/drm2/ttm/ttm_bo.c Sun Aug 25 14:55:08 2013 (r254866) +++ head/sys/dev/drm2/ttm/ttm_bo.c Sun Aug 25 14:56:14 2013 (r254867) @@ -475,6 +475,7 @@ static int ttm_bo_handle_move_mem(struct bo->mem = tmp_mem; bdev->driver->move_notify(bo, mem); bo->mem = *mem; + *mem = tmp_mem; } goto out_err;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201308251456.r7PEuEF1049983>