During free we unconditionally delete the bo from the vma cache. This
relies on the its list member being kept in a sane state. This fails
after the object is purged, as the purge operation performs a pure
deletion and doesn't reset the list member, leaving a pair of dangling
pointers.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
bufmgr_gem->vma_cache.next,
vma_list);
assert(bo_gem->map_count == 0);
- DRMLISTDEL(&bo_gem->vma_list);
+ DRMLISTDELINIT(&bo_gem->vma_list);
if (bo_gem->mem_virtual) {
munmap(bo_gem->mem_virtual, bo_gem->bo.size);