From: Sebastian Biemueller Date: Wed, 29 Feb 2012 16:04:52 +0000 (-0500) Subject: drm/radeon/kms/vm: fix possible bug in radeon_vm_bo_rmv() X-Git-Tag: firefly_0821_release~3680^2~3457^2 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=108b0d348302be2b2f846bc8a8115f5b099a6196;p=firefly-linux-kernel-4.4.55.git drm/radeon/kms/vm: fix possible bug in radeon_vm_bo_rmv() The bo is removed from the list at the top of radeon_vm_bo_rmv(), but then the list is used in radeon_vm_bo_update_pte() to look up the vm. remove the bo_list entry at the end of the function instead. Signed-off-by: Alex Deucher Reviewed-by: Jerome Glisse Signed-off-by: Dave Airlie --- diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c index 010dad8b66ae..c58a036233fb 100644 --- a/drivers/gpu/drm/radeon/radeon_gart.c +++ b/drivers/gpu/drm/radeon/radeon_gart.c @@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev, if (bo_va == NULL) return 0; - list_del(&bo_va->bo_list); mutex_lock(&vm->mutex); radeon_mutex_lock(&rdev->cs_mutex); radeon_vm_bo_update_pte(rdev, vm, bo, NULL); radeon_mutex_unlock(&rdev->cs_mutex); list_del(&bo_va->vm_list); mutex_unlock(&vm->mutex); + list_del(&bo_va->bo_list); kfree(bo_va); return 0;