Module Name: src
Committed By: riastradh
Date: Sun Jul 27 00:40:40 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/dist/drm/ttm: ttm_bo.c ttm_tt.c
Log Message:
Revert ttm_bo.c 1.3 and try to fix the double-free properly.
bo->destroy doesn't ttm_tt_destroy or ttm_tt_fini anything. Trouble
is that ttm_tt_fini expects the swap storage to still be there, and
ttm_tt_destroy -- which is what calls ttm_tt_fini by way of
ttm->func->destroy -- has already nulled it out.
To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c
cvs rdiff -u -r1.5 -r1.6 src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c
diff -u src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:1.3 src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:1.4
--- src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c:1.3 Sat Jul 26 06:34:12 2014
+++ src/sys/external/bsd/drm2/dist/drm/ttm/ttm_bo.c Sun Jul 27 00:40:39 2014
@@ -159,7 +159,7 @@ static void ttm_bo_release_list(struct k
BUG_ON(!list_empty(&bo->lru));
BUG_ON(!list_empty(&bo->ddestroy));
- if (bo->destroy == NULL && bo->ttm)
+ if (bo->ttm)
ttm_tt_destroy(bo->ttm);
atomic_dec(&bo->glob->bo_count);
if (bo->resv == &bo->ttm_resv)
Index: src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c
diff -u src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c:1.5 src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c:1.6
--- src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c:1.5 Sat Jul 26 12:27:57 2014
+++ src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c Sun Jul 27 00:40:39 2014
@@ -185,9 +185,9 @@ void ttm_tt_destroy(struct ttm_tt *ttm)
if (!(ttm->page_flags & TTM_PAGE_FLAG_PERSISTENT_SWAP) &&
ttm->swap_storage)
fput(ttm->swap_storage);
-#endif
ttm->swap_storage = NULL;
+#endif
ttm->func->destroy(ttm);
}
