lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Revert "ttm: Include the 'struct dev' when using the DMA API."

Browse Source 
This reverts commit 5a893fc28f.

This causes a use after free in the ttm free alloc pages path,
when it tries to get the be after the be has been destroyed.

Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Dave Airlie
2011-02-23 14:24:01 +10:00
parent 63871f89d1
commit a2c06ee2fe
7 changed files with 10 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/ttm/ttm_tt.c
View File

@@ -110,7 +110,7 @@ static struct page *__ttm_tt_get_page(struct ttm_tt *ttm, int index)
INIT_LIST_HEAD(&h);
ret = ttm_get_pages(&h, ttm->page_flags, ttm->caching_state, 1,
&ttm->dma_address[index], ttm->be->bdev->dev);
&ttm->dma_address[index]);
if (ret != 0)
return NULL;
@@ -304,7 +304,7 @@ static void ttm_tt_free_alloced_pages(struct ttm_tt *ttm)
}
}
ttm_put_pages(&h, count, ttm->page_flags, ttm->caching_state,
ttm->dma_address, ttm->be->bdev->dev);
ttm->dma_address);
ttm->state = tt_unpopulated;
ttm->first_himem_page = ttm->num_pages;
ttm->last_lomem_page = -1;