drm/nouveau: fix a nouveau_bo dereference after it's been destroyed
authorBen Skeggs <bskeggs@redhat.com>
Thu, 15 Apr 2010 04:42:34 +0000 (14:42 +1000)
committerBen Skeggs <bskeggs@redhat.com>
Wed, 19 May 2010 03:15:14 +0000 (13:15 +1000)
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drivers/gpu/drm/nouveau/nouveau_bo.c

index fb164efada3b29aecc9578c86c9f5aef53effdac..6f3c195223772bf9adc6884db52b24711fdb32a1 100644 (file)
@@ -160,11 +160,11 @@ nouveau_bo_new(struct drm_device *dev, struct nouveau_channel *chan,
        ret = ttm_bo_init(&dev_priv->ttm.bdev, &nvbo->bo, size,
                          ttm_bo_type_device, &nvbo->placement, align, 0,
                          false, NULL, size, nouveau_bo_del_ttm);
-       nvbo->channel = NULL;
        if (ret) {
                /* ttm will call nouveau_bo_del_ttm if it fails.. */
                return ret;
        }
+       nvbo->channel = NULL;
 
        spin_lock(&dev_priv->ttm.bo_list_lock);
        list_add_tail(&nvbo->head, &dev_priv->ttm.bo_list);