Commit eac20953 authored by Ben Skeggs's avatar Ben Skeggs Committed by Dave Airlie

drm/ttm: unbind ttm before destroying node in accel move cleanup

Nouveau makes the assumption that if a TTM is bound there will be a mm_node
around for it and the backwards ordering here resulted in a use-after-free
on some eviction paths.
Signed-off-by: default avatarBen Skeggs <>
Signed-off-by: default avatarDave Airlie <>
parent 7c4c3960
......@@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
if (ret)
return ret;
if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
(bo->ttm != NULL)) {
bo->ttm = NULL;
} else {
* This should help pipeline ordinary buffer moves.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment