svn commit: r254866 - head/sys/dev/drm2/ttm

[Jean-Sebastien Pedron]

Author: dumbbell
Date: Sun Aug 25 14:55:08 2013
New Revision: 254866
URL: http://svnweb.freebsd.org/changeset/base/254866

Log:
  drm/ttm: Import Linux commit 630541863b29f88c7ab34e647758344e4cd1eafd
  
  Author: Dave Airlie <airlied at gmail.com>
  Date:   Wed Jan 16 14:25:44 2013 +1000
  
      ttm: don't destroy old mm_node on memcpy failure
  
      When we are using memcpy to move objects around, and we fail to memcpy
      due to lack of memory to populate or failure to finish the copy, we don't
      want to destroy the mm_node that has been copied into old_copy.
  
      While working on a new kms driver that uses memcpy, if I overallocated bo's
      up to the memory limits, and eviction failed, then machine would oops soon
      after due to having an active bo with an already freed drm_mm embedded in it,
      freeing it a second time didn't end well.
  
      Reviewed-by: Jerome Glisse <jglisse at redhat.com>
      Signed-off-by: Dave Airlie <airlied at redhat.com>
  
  Approved by:	kib@

Modified:
  head/sys/dev/drm2/ttm/ttm_bo_util.c

Modified: head/sys/dev/drm2/ttm/ttm_bo_util.c
==============================================================================
--- head/sys/dev/drm2/ttm/ttm_bo_util.c	Sun Aug 25 14:53:39 2013	(r254865)
+++ head/sys/dev/drm2/ttm/ttm_bo_util.c	Sun Aug 25 14:55:08 2013	(r254866)
@@ -321,8 +321,12 @@ int ttm_bo_move_memcpy(struct ttm_buffer
 
 	if (ttm->state == tt_unpopulated) {
 		ret = ttm->bdev->driver->ttm_tt_populate(ttm);
-		if (ret)
+		if (ret) {
+			/* if we fail here don't nuke the mm node
+			 * as the bo still owns it */
+			old_copy.mm_node = NULL;
 			goto out1;
+		}
 	}
 
 	add = 0;
@@ -346,8 +350,11 @@ int ttm_bo_move_memcpy(struct ttm_buffer
 						   prot);
 		} else
 			ret = ttm_copy_io_page(new_iomap, old_iomap, page);
-		if (ret)
+		if (ret) {
+			/* failing here, means keep old copy as-is */
+			old_copy.mm_node = NULL;
 			goto out1;
+		}
 	}
 	mb();
 out2: