[PATCH] drm/radeon/kms/vm: fix possible bug in radeon_vm_bo_rmv()

[Jerome Glisse]

On Wed, 2012-02-29 at 11:04 -0500, alexdeucher at gmail.com wrote:
> From: Sebastian Biemueller <sebastian.biemueller at amd.com>
> 
> The bo is removed from the list at the top of
> radeon_vm_bo_rmv(), but then the list is used
> in radeon_vm_bo_update_pte() to look up the vm.
> remove the bo_list entry at the end of the
> function instead.
> 
> Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
> Cc: Jerome Glisse <j.glisse at gmail.com>

Reviewed-by: Jerome Glisse <jglisse at redhat.com>

> ---
>  drivers/gpu/drm/radeon/radeon_gart.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
> index 010dad8..c58a036 100644
> --- a/drivers/gpu/drm/radeon/radeon_gart.c
> +++ b/drivers/gpu/drm/radeon/radeon_gart.c
> @@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
>  	if (bo_va == NULL)
>  		return 0;
>  
> -	list_del(&bo_va->bo_list);
>  	mutex_lock(&vm->mutex);
>  	radeon_mutex_lock(&rdev->cs_mutex);
>  	radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
>  	radeon_mutex_unlock(&rdev->cs_mutex);
>  	list_del(&bo_va->vm_list);
>  	mutex_unlock(&vm->mutex);
> +	list_del(&bo_va->bo_list);
>  
>  	kfree(bo_va);
>  	return 0;