diff options
| author | Dave Airlie <airlied@redhat.com> | 2011-02-23 14:24:01 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2011-02-23 14:24:01 +1000 |
| commit | a2c06ee2fe5b48a71e697bae00c6e7195fc016b6 (patch) | |
| tree | ff1761280d173d8adc0a7e0339dc68fd44146c08 /drivers/gpu/drm/ttm/ttm_page_alloc.c | |
| parent | 63871f89d158e3f3e469dde00dd15763d474cb3c (diff) | |
| download | kernel_samsung_smdk4412-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.zip kernel_samsung_smdk4412-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.tar.gz kernel_samsung_smdk4412-a2c06ee2fe5b48a71e697bae00c6e7195fc016b6.tar.bz2 | |
Revert "ttm: Include the 'struct dev' when using the DMA API."
This reverts commit 5a893fc28f0393adb7c885a871b8c59e623fd528.
This causes a use after free in the ttm free alloc pages path,
when it tries to get the be after the be has been destroyed.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/ttm/ttm_page_alloc.c')
| -rw-r--r-- | drivers/gpu/drm/ttm/ttm_page_alloc.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c index 35849db..737a2a2 100644 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c @@ -664,7 +664,7 @@ out: */ int ttm_get_pages(struct list_head *pages, int flags, enum ttm_caching_state cstate, unsigned count, - dma_addr_t *dma_address, struct device *dev) + dma_addr_t *dma_address) { struct ttm_page_pool *pool = ttm_get_pool(flags, cstate); struct page *p = NULL; @@ -685,7 +685,7 @@ int ttm_get_pages(struct list_head *pages, int flags, for (r = 0; r < count; ++r) { if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) { void *addr; - addr = dma_alloc_coherent(dev, PAGE_SIZE, + addr = dma_alloc_coherent(NULL, PAGE_SIZE, &dma_address[r], gfp_flags); if (addr == NULL) @@ -730,7 +730,7 @@ int ttm_get_pages(struct list_head *pages, int flags, printk(KERN_ERR TTM_PFX "Failed to allocate extra pages " "for large request."); - ttm_put_pages(pages, 0, flags, cstate, NULL, NULL); + ttm_put_pages(pages, 0, flags, cstate, NULL); return r; } } @@ -741,8 +741,7 @@ int ttm_get_pages(struct list_head *pages, int flags, /* Put all pages in pages list to correct pool to wait for reuse */ void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags, - enum ttm_caching_state cstate, dma_addr_t *dma_address, - struct device *dev) + enum ttm_caching_state cstate, dma_addr_t *dma_address) { unsigned long irq_flags; struct ttm_page_pool *pool = ttm_get_pool(flags, cstate); @@ -758,7 +757,7 @@ void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags, void *addr = page_address(p); WARN_ON(!addr || !dma_address[r]); if (addr) - dma_free_coherent(dev, PAGE_SIZE, + dma_free_coherent(NULL, PAGE_SIZE, addr, dma_address[r]); dma_address[r] = 0; |