drm/radeon/kms/vm: fix possible bug in radeon_vm_bo_rmv()

The bo is removed from the list at the top of
radeon_vm_bo_rmv(), but then the list is used
in radeon_vm_bo_update_pte() to look up the vm.
remove the bo_list entry at the end of the
function instead.

Signed-off-by: Alex Deucher <[email protected]>
Reviewed-by: Jerome Glisse <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>

diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 010dad8b66ae98902f3b7c4ffb61d426103ef07f..c58a036233fb4409b3b4b656a1aba1c103b1b40a 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
        if (bo_va == NULL)
                return 0;
 
-       list_del(&bo_va->bo_list);
        mutex_lock(&vm->mutex);
        radeon_mutex_lock(&rdev->cs_mutex);
        radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
        radeon_mutex_unlock(&rdev->cs_mutex);
        list_del(&bo_va->vm_list);
        mutex_unlock(&vm->mutex);
+       list_del(&bo_va->bo_list);
 
        kfree(bo_va);
        return 0;