tree 2eb4d451cec0837e096ec5ec2ce86b27a000d00f
parent 379791a66688385cf75c8aece1a81fc68f536cd4
author Ben Skeggs <bskeggs@redhat.com> 1313982904 +0000
committer Greg Kroah-Hartman <gregkh@suse.de> 1319519415 +0200

drm/ttm: unbind ttm before destroying node in accel move cleanup

commit eac2095398668f989a3dd8d00be1b87850d78c01 upstream.

Nouveau makes the assumption that if a TTM is bound there will be a mm_node
around for it and the backwards ordering here resulted in a use-after-free
on some eviction paths.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>