Commit eac20953 authored by Ben Skeggs's avatar Ben Skeggs Committed by Dave Airlie

drm/ttm: unbind ttm before destroying node in accel move cleanup

Nouveau makes the assumption that if a TTM is bound there will be a mm_node
around for it and the backwards ordering here resulted in a use-after-free
on some eviction paths.
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 7c4c3960
...@@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo, ...@@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
if (ret) if (ret)
return ret; return ret;
ttm_bo_free_old_node(bo);
if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) && if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
(bo->ttm != NULL)) { (bo->ttm != NULL)) {
ttm_tt_unbind(bo->ttm); ttm_tt_unbind(bo->ttm);
ttm_tt_destroy(bo->ttm); ttm_tt_destroy(bo->ttm);
bo->ttm = NULL; bo->ttm = NULL;
} }
ttm_bo_free_old_node(bo);
} else { } else {
/** /**
* This should help pipeline ordinary buffer moves. * This should help pipeline ordinary buffer moves.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment