drm/nouveau: fix a nouveau_bo dereference after it's been destroyed

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index fb164efada3b29aecc9578c86c9f5aef53effdac..6f3c195223772bf9adc6884db52b24711fdb32a1 100644 (file)
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -160,11 +160,11 @@ nouveau_bo_new(struct drm_device *dev, struct nouveau_channel *chan,
        ret = ttm_bo_init(&dev_priv->ttm.bdev, &nvbo->bo, size,
                          ttm_bo_type_device, &nvbo->placement, align, 0,
                          false, NULL, size, nouveau_bo_del_ttm);
-       nvbo->channel = NULL;
        if (ret) {
                /* ttm will call nouveau_bo_del_ttm if it fails.. */
                return ret;
        }
+       nvbo->channel = NULL;
 
        spin_lock(&dev_priv->ttm.bo_list_lock);
        list_add_tail(&nvbo->head, &dev_priv->ttm.bo_list);