aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/vmwgfx
diff options
context:
space:
mode:
authorDave Airlie <airlied@redhat.com>2011-02-22 23:24:01 -0500
committerDave Airlie <airlied@redhat.com>2011-02-22 23:24:01 -0500
commita2c06ee2fe5b48a71e697bae00c6e7195fc016b6 (patch)
treeff1761280d173d8adc0a7e0339dc68fd44146c08 /drivers/gpu/drm/vmwgfx
parent63871f89d158e3f3e469dde00dd15763d474cb3c (diff)
Revert "ttm: Include the 'struct dev' when using the DMA API."
This reverts commit 5a893fc28f0393adb7c885a871b8c59e623fd528. This causes a use after free in the ttm free alloc pages path, when it tries to get the be after the be has been destroyed. Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/vmwgfx')
-rw-r--r--drivers/gpu/drm/vmwgfx/vmwgfx_drv.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index df04661e2b93..96949b93d920 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -322,7 +322,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
322 ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM); 322 ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
323 dev_priv->active_master = &dev_priv->fbdev_master; 323 dev_priv->active_master = &dev_priv->fbdev_master;
324 324
325 dev_priv->bdev.dev = dev->dev; 325
326 ret = ttm_bo_device_init(&dev_priv->bdev, 326 ret = ttm_bo_device_init(&dev_priv->bdev,
327 dev_priv->bo_global_ref.ref.object, 327 dev_priv->bo_global_ref.ref.object,
328 &vmw_bo_driver, VMWGFX_FILE_PAGE_OFFSET, 328 &vmw_bo_driver, VMWGFX_FILE_PAGE_OFFSET,