diff options
author | Dave Airlie <airlied@redhat.com> | 2011-02-22 23:24:01 -0500 |
---|---|---|
committer | Dave Airlie <airlied@redhat.com> | 2011-02-22 23:24:01 -0500 |
commit | a2c06ee2fe5b48a71e697bae00c6e7195fc016b6 (patch) | |
tree | ff1761280d173d8adc0a7e0339dc68fd44146c08 /drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | |
parent | 63871f89d158e3f3e469dde00dd15763d474cb3c (diff) |
Revert "ttm: Include the 'struct dev' when using the DMA API."
This reverts commit 5a893fc28f0393adb7c885a871b8c59e623fd528.
This causes a use after free in the ttm free alloc pages path,
when it tries to get the be after the be has been destroyed.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/vmwgfx/vmwgfx_drv.c')
-rw-r--r-- | drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c index df04661e2b9..96949b93d92 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | |||
@@ -322,7 +322,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) | |||
322 | ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM); | 322 | ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM); |
323 | dev_priv->active_master = &dev_priv->fbdev_master; | 323 | dev_priv->active_master = &dev_priv->fbdev_master; |
324 | 324 | ||
325 | dev_priv->bdev.dev = dev->dev; | 325 | |
326 | ret = ttm_bo_device_init(&dev_priv->bdev, | 326 | ret = ttm_bo_device_init(&dev_priv->bdev, |
327 | dev_priv->bo_global_ref.ref.object, | 327 | dev_priv->bo_global_ref.ref.object, |
328 | &vmw_bo_driver, VMWGFX_FILE_PAGE_OFFSET, | 328 | &vmw_bo_driver, VMWGFX_FILE_PAGE_OFFSET, |