Ben Skeggs 726e2766e0 drm/ttm: unbind ttm before destroying node in accel move cleanup ... commit eac2095398 upstream. Nouveau makes the assumption that if a TTM is bound there will be a mm_node around for it and the backwards ordering here resulted in a use-after-free on some eviction paths. Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Cc: Josh Boyer <jwboyer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2011-10-25 07:10:15 +02:00
..
Makefile	drm/ttm: restructure to allow driver to plug in alternate memory manager	2010-10-05 10:01:20 +10:00
ttm_agp_backend.c	ttm: Expand (*populate) to support an array of DMA addresses.	2011-01-27 16:07:58 -05:00
ttm_bo.c	drm/ttm: ensure ttm for new node is bound before calling move_notify()	2011-10-25 07:10:15 +02:00
ttm_bo_manager.c	drm/ttm: Use private locks for the default bo range manager	2010-11-09 13:33:24 +10:00
ttm_bo_util.c	drm/ttm: unbind ttm before destroying node in accel move cleanup	2011-10-25 07:10:15 +02:00
ttm_bo_vm.c	drm/ttm: Fix up io_mem_reserve / io_mem_free calling	2010-11-22 13:25:22 +10:00
ttm_execbuf_util.c	drm/ttm/vmwgfx: Have TTM manage the validation sequence.	2010-11-22 13:25:21 +10:00
ttm_lock.c	drm/ttm: Remove some leftover debug messages.	2010-05-07 09:20:56 +10:00
ttm_memory.c	Merge branch 'drm-ttm-pool' into drm-core-next	2010-04-20 13:12:28 +10:00
ttm_module.c	drm: move ttm global code to core drm	2010-08-04 09:46:06 +10:00
ttm_object.c	drm: minor kref_put() nits	2011-04-10 17:01:02 +02:00
ttm_page_alloc.c	vmscan: change shrinker API by passing shrink_control struct	2011-05-25 08:39:26 -07:00
ttm_tt.c	drm/ttm: use shmem_read_mapping_page	2011-06-27 18:00:13 -07:00