diff options
| author | Dave Airlie <airlied@redhat.com> | 2011-02-22 23:24:01 -0500 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2011-02-22 23:24:01 -0500 |
| commit | a2c06ee2fe5b48a71e697bae00c6e7195fc016b6 (patch) | |
| tree | ff1761280d173d8adc0a7e0339dc68fd44146c08 /include/drm | |
| parent | 63871f89d158e3f3e469dde00dd15763d474cb3c (diff) | |
Revert "ttm: Include the 'struct dev' when using the DMA API."
This reverts commit 5a893fc28f0393adb7c885a871b8c59e623fd528.
This causes a use after free in the ttm free alloc pages path,
when it tries to get the be after the be has been destroyed.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'include/drm')
| -rw-r--r-- | include/drm/ttm/ttm_bo_driver.h | 1 | ||||
| -rw-r--r-- | include/drm/ttm/ttm_page_alloc.h | 8 |
2 files changed, 2 insertions, 7 deletions
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h index 38ff0682260..efed0820d9f 100644 --- a/include/drm/ttm/ttm_bo_driver.h +++ b/include/drm/ttm/ttm_bo_driver.h | |||
| @@ -551,7 +551,6 @@ struct ttm_bo_device { | |||
| 551 | struct list_head device_list; | 551 | struct list_head device_list; |
| 552 | struct ttm_bo_global *glob; | 552 | struct ttm_bo_global *glob; |
| 553 | struct ttm_bo_driver *driver; | 553 | struct ttm_bo_driver *driver; |
| 554 | struct device *dev; | ||
| 555 | rwlock_t vm_lock; | 554 | rwlock_t vm_lock; |
| 556 | struct ttm_mem_type_manager man[TTM_NUM_MEM_TYPES]; | 555 | struct ttm_mem_type_manager man[TTM_NUM_MEM_TYPES]; |
| 557 | spinlock_t fence_lock; | 556 | spinlock_t fence_lock; |
diff --git a/include/drm/ttm/ttm_page_alloc.h b/include/drm/ttm/ttm_page_alloc.h index ccb6b7a240e..8062890f725 100644 --- a/include/drm/ttm/ttm_page_alloc.h +++ b/include/drm/ttm/ttm_page_alloc.h | |||
| @@ -37,14 +37,12 @@ | |||
| 37 | * @cstate: ttm caching state for the page. | 37 | * @cstate: ttm caching state for the page. |
| 38 | * @count: number of pages to allocate. | 38 | * @count: number of pages to allocate. |
| 39 | * @dma_address: The DMA (bus) address of pages (if TTM_PAGE_FLAG_DMA32 set). | 39 | * @dma_address: The DMA (bus) address of pages (if TTM_PAGE_FLAG_DMA32 set). |
| 40 | * @dev: struct device for appropiate DMA accounting. | ||
| 41 | */ | 40 | */ |
| 42 | int ttm_get_pages(struct list_head *pages, | 41 | int ttm_get_pages(struct list_head *pages, |
| 43 | int flags, | 42 | int flags, |
| 44 | enum ttm_caching_state cstate, | 43 | enum ttm_caching_state cstate, |
| 45 | unsigned count, | 44 | unsigned count, |
| 46 | dma_addr_t *dma_address, | 45 | dma_addr_t *dma_address); |
| 47 | struct device *dev); | ||
| 48 | /** | 46 | /** |
| 49 | * Put linked list of pages to pool. | 47 | * Put linked list of pages to pool. |
| 50 | * | 48 | * |
| @@ -54,14 +52,12 @@ int ttm_get_pages(struct list_head *pages, | |||
| 54 | * @flags: ttm flags for page allocation. | 52 | * @flags: ttm flags for page allocation. |
| 55 | * @cstate: ttm caching state. | 53 | * @cstate: ttm caching state. |
| 56 | * @dma_address: The DMA (bus) address of pages (if TTM_PAGE_FLAG_DMA32 set). | 54 | * @dma_address: The DMA (bus) address of pages (if TTM_PAGE_FLAG_DMA32 set). |
| 57 | * @dev: struct device for appropiate DMA accounting. | ||
| 58 | */ | 55 | */ |
| 59 | void ttm_put_pages(struct list_head *pages, | 56 | void ttm_put_pages(struct list_head *pages, |
| 60 | unsigned page_count, | 57 | unsigned page_count, |
| 61 | int flags, | 58 | int flags, |
| 62 | enum ttm_caching_state cstate, | 59 | enum ttm_caching_state cstate, |
| 63 | dma_addr_t *dma_address, | 60 | dma_addr_t *dma_address); |
| 64 | struct device *dev); | ||
| 65 | /** | 61 | /** |
| 66 | * Initialize pool allocator. | 62 | * Initialize pool allocator. |
| 67 | */ | 63 | */ |
