aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/nouveau/nouveau_svm.c
diff options
context:
space:
mode:
authorJason Gunthorpe <jgg@mellanox.com>2019-05-23 09:41:19 -0300
committerJason Gunthorpe <jgg@mellanox.com>2019-06-10 10:10:30 -0300
commite36acfe6c86d13eec62321e1e86a1ce287e52e7d (patch)
treedce3ca3311aa436c629a5443b126dd73865177df /drivers/gpu/drm/nouveau/nouveau_svm.c
parentmm/hmm: fix use after free with struct hmm in the mmu notifiers (diff)
downloadlinux-dev-e36acfe6c86d13eec62321e1e86a1ce287e52e7d.tar.xz
linux-dev-e36acfe6c86d13eec62321e1e86a1ce287e52e7d.zip
mm/hmm: Use hmm_mirror not mm as an argument for hmm_range_register
Ralph observes that hmm_range_register() can only be called by a driver while a mirror is registered. Make this clear in the API by passing in the mirror structure as a parameter. This also simplifies understanding the lifetime model for struct hmm, as the hmm pointer must be valid as part of a registered mirror so all we need in hmm_register_range() is a simple kref_get. Suggested-by: Ralph Campbell <rcampbell@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Reviewed-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Ralph Campbell <rcampbell@nvidia.com> Reviewed-by: Ira Weiny <ira.weiny@intel.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Tested-by: Philip Yang <Philip.Yang@amd.com>
Diffstat (limited to 'drivers/gpu/drm/nouveau/nouveau_svm.c')
-rw-r--r--drivers/gpu/drm/nouveau/nouveau_svm.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
index 93ed43c413f0..8c92374afcf2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -649,7 +649,7 @@ nouveau_svm_fault(struct nvif_notify *notify)
range.values = nouveau_svm_pfn_values;
range.pfn_shift = NVIF_VMM_PFNMAP_V0_ADDR_SHIFT;
again:
- ret = hmm_vma_fault(&range, true);
+ ret = hmm_vma_fault(&svmm->mirror, &range, true);
if (ret == 0) {
mutex_lock(&svmm->mutex);
if (!hmm_vma_range_done(&range)) {