svn commit: r254867 - head/sys/dev/drm2/ttm

[Jean-Sebastien Pedron]

Author: dumbbell
Date: Sun Aug 25 14:56:14 2013
New Revision: 254867
URL: http://svnweb.freebsd.org/changeset/base/254867

Log:
  drm/ttm: Import Linux commit 014b34409fb2015f63663b6cafdf557fdf289628
  
  Author: Dave Airlie <airlied at gmail.com>
  Date:   Wed Jan 16 15:58:34 2013 +1000
  
      ttm: on move memory failure don't leave a node dangling
  
      if we have a move notify callback, when moving fails, we call move notify
      the opposite way around, however this ends up with *mem containing the mm_node
      from the bo, which means we double free it. This is a follow on to the previous
      fix.
  
      Reviewed-by: Jerome Glisse <jglisse at redhat.com>
      Signed-off-by: Dave Airlie <airlied at redhat.com>
  
  Approved by:	kib@

Modified:
  head/sys/dev/drm2/ttm/ttm_bo.c

Modified: head/sys/dev/drm2/ttm/ttm_bo.c
==============================================================================
--- head/sys/dev/drm2/ttm/ttm_bo.c	Sun Aug 25 14:55:08 2013	(r254866)
+++ head/sys/dev/drm2/ttm/ttm_bo.c	Sun Aug 25 14:56:14 2013	(r254867)
@@ -475,6 +475,7 @@ static int ttm_bo_handle_move_mem(struct
 			bo->mem = tmp_mem;
 			bdev->driver->move_notify(bo, mem);
 			bo->mem = *mem;
+			*mem = tmp_mem;
 		}
 
 		goto out_err;