On Wed, Jan 16, 2013 at 1:01 AM, Dave Airlie <airlied@xxxxxxxxx> wrote: > if we have a move notify callback, when moving fails, we call move notify > the opposite way around, however this ends up with *mem containing the mm_node > from the bo, which means we double free it. This is a follow on to the previous > fix. > > Signed-off-by: Dave Airlie <airlied@xxxxxxxxxx> Reviewed-by: Jerome Glisse <jglisse@xxxxxxxxxx> > --- > drivers/gpu/drm/ttm/ttm_bo.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c > index cd64ead..076024e 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo.c > +++ b/drivers/gpu/drm/ttm/ttm_bo.c > @@ -434,6 +434,7 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo, > bo->mem = tmp_mem; > bdev->driver->move_notify(bo, mem); > bo->mem = *mem; > + *mem = tmp_mem; > } > > goto out_err; > -- > 1.8.1 > > _______________________________________________ > dri-devel mailing list > dri-devel@xxxxxxxxxxxxxxxxxxxxx > http://lists.freedesktop.org/mailman/listinfo/dri-devel _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/dri-devel
