On Wed, Jan 16, 2013 at 1:01 AM, Dave Airlie <airlied at gmail.com> wrote: > if we have a move notify callback, when moving fails, we call move notify > the opposite way around, however this ends up with *mem containing the mm_node > from the bo, which means we double free it. This is a follow on to the > previous > fix. > > Signed-off-by: Dave Airlie <airlied at redhat.com>
Reviewed-by: Jerome Glisse <jglisse at redhat.com> > --- > drivers/gpu/drm/ttm/ttm_bo.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c > index cd64ead..076024e 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo.c > +++ b/drivers/gpu/drm/ttm/ttm_bo.c > @@ -434,6 +434,7 @@ static int ttm_bo_handle_move_mem(struct > ttm_buffer_object *bo, > bo->mem = tmp_mem; > bdev->driver->move_notify(bo, mem); > bo->mem = *mem; > + *mem = tmp_mem; > } > > goto out_err; > -- > 1.8.1 > > _______________________________________________ > dri-devel mailing list > dri-devel at lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/dri-devel
