summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDave Airlie <airlied@gmail.com>2013-01-16 15:58:34 +1000
committerDave Airlie <airlied@redhat.com>2013-01-21 13:45:23 +1000
commit014b34409fb2015f63663b6cafdf557fdf289628 (patch)
treefd30b4512a1f2a992c03bcf808ead98f4d1b21fa
parent630541863b29f88c7ab34e647758344e4cd1eafd (diff)
downloadlinux-3.10-014b34409fb2015f63663b6cafdf557fdf289628.tar.gz
linux-3.10-014b34409fb2015f63663b6cafdf557fdf289628.tar.bz2
linux-3.10-014b34409fb2015f63663b6cafdf557fdf289628.zip
ttm: on move memory failure don't leave a node dangling
if we have a move notify callback, when moving fails, we call move notify the opposite way around, however this ends up with *mem containing the mm_node from the bo, which means we double free it. This is a follow on to the previous fix. Reviewed-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
-rw-r--r--drivers/gpu/drm/ttm/ttm_bo.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 33d20be87db..52b20b12c83 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -434,6 +434,7 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
bo->mem = tmp_mem;
bdev->driver->move_notify(bo, mem);
bo->mem = *mem;
+ *mem = tmp_mem;
}
goto out_err;