Ben Skeggs 726e2766e0 drm/ttm: unbind ttm before destroying node in accel move cleanup ...

commit eac2095398668f989a3dd8d00be1b87850d78c01 upstream.

Nouveau makes the assumption that if a TTM is bound there will be a mm_node
around for it and the backwards ordering here resulted in a use-after-free
on some eviction paths.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2011-10-25 07:10:15 +02:00

..

Makefile

drm/ttm: restructure to allow driver to plug in alternate memory manager

2010-10-05 10:01:20 +10:00

ttm_agp_backend.c

ttm: Expand (*populate) to support an array of DMA addresses.

2011-01-27 16:07:58 -05:00

ttm_bo_manager.c

drm/ttm: Use private locks for the default bo range manager

2010-11-09 13:33:24 +10:00

ttm_bo_util.c

drm/ttm: unbind ttm before destroying node in accel move cleanup

2011-10-25 07:10:15 +02:00

ttm_bo_vm.c

drm/ttm: Fix up io_mem_reserve / io_mem_free calling

2010-11-22 13:25:22 +10:00

ttm_bo.c

drm/ttm: ensure ttm for new node is bound before calling move_notify()

2011-10-25 07:10:15 +02:00

ttm_execbuf_util.c

drm/ttm/vmwgfx: Have TTM manage the validation sequence.

2010-11-22 13:25:21 +10:00

ttm_lock.c

drm/ttm: Remove some leftover debug messages.

2010-05-07 09:20:56 +10:00

ttm_memory.c

Merge branch 'drm-ttm-pool' into drm-core-next

2010-04-20 13:12:28 +10:00

ttm_module.c

drm: move ttm global code to core drm

2010-08-04 09:46:06 +10:00

ttm_object.c

drm: minor kref_put() nits

2011-04-10 17:01:02 +02:00

ttm_page_alloc.c

vmscan: change shrinker API by passing shrink_control struct

2011-05-25 08:39:26 -07:00

ttm_tt.c

drm/ttm: use shmem_read_mapping_page

2011-06-27 18:00:13 -07:00