diff options
| author | Dave Airlie | 2011-02-23 05:24:01 +0100 |
|---|---|---|
| committer | Dave Airlie | 2011-02-23 05:24:01 +0100 |
| commit | a2c06ee2fe5b48a71e697bae00c6e7195fc016b6 (patch) | |
| tree | ff1761280d173d8adc0a7e0339dc68fd44146c08 /drivers/gpu/drm/ttm/ttm_tt.c | |
| parent | Merge branch 'drm-mm-cleanup' into drm-next (diff) | |
| download | kernel-qcow2-linux-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.tar.gz kernel-qcow2-linux-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.tar.xz kernel-qcow2-linux-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.zip | |
Revert "ttm: Include the 'struct dev' when using the DMA API."
This reverts commit 5a893fc28f0393adb7c885a871b8c59e623fd528.
This causes a use after free in the ttm free alloc pages path,
when it tries to get the be after the be has been destroyed.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/ttm/ttm_tt.c')
| -rw-r--r-- | drivers/gpu/drm/ttm/ttm_tt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c index 0f8fc9ff0c53..86d5b1745a45 100644 --- a/drivers/gpu/drm/ttm/ttm_tt.c +++ b/drivers/gpu/drm/ttm/ttm_tt.c @@ -110,7 +110,7 @@ static struct page *__ttm_tt_get_page(struct ttm_tt *ttm, int index) INIT_LIST_HEAD(&h); ret = ttm_get_pages(&h, ttm->page_flags, ttm->caching_state, 1, - &ttm->dma_address[index], ttm->be->bdev->dev); + &ttm->dma_address[index]); if (ret != 0) return NULL; @@ -304,7 +304,7 @@ static void ttm_tt_free_alloced_pages(struct ttm_tt *ttm) } } ttm_put_pages(&h, count, ttm->page_flags, ttm->caching_state, - ttm->dma_address, ttm->be->bdev->dev); + ttm->dma_address); ttm->state = tt_unpopulated; ttm->first_himem_page = ttm->num_pages; ttm->last_lomem_page = -1; |