From 72f10b46d411d0dc2529cfd88b7ff3fe0de9af08 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
Date: Wed, 21 Jan 2009 14:11:11 +0100
Subject: [PATCH] Don't free object while information in them are used for
 accounting purposes. Fix by Alan Hourihane.

---
 linux-core/ttm/ttm_bo.c             | 2 +-
 linux-core/ttm/ttm_object.c         | 4 ++--
 linux-core/ttm/ttm_placement_user.c | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/linux-core/ttm/ttm_bo.c b/linux-core/ttm/ttm_bo.c
index 631a219b..6595d5a3 100644
--- a/linux-core/ttm/ttm_bo.c
+++ b/linux-core/ttm/ttm_bo.c
@@ -70,8 +70,8 @@ static void ttm_bo_release_list(struct kref *list_kref)
 	if (bo->destroy)
 		bo->destroy(bo);
 	else {
-		kfree(bo);
 		ttm_mem_global_free(bdev->mem_glob, bo->acc_size, 0);
+		kfree(bo);
 	}
 }
 
diff --git a/linux-core/ttm/ttm_object.c b/linux-core/ttm/ttm_object.c
index 85868259..5eba6b71 100644
--- a/linux-core/ttm/ttm_object.c
+++ b/linux-core/ttm/ttm_object.c
@@ -266,8 +266,8 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
 		write_unlock(&tfile->lock);
 		BUG_ON(ret != -EINVAL);
 
-		kfree(ref);
 		ttm_mem_global_free(mem_glob, sizeof(*ref), 0);
+		kfree(ref);
 	}
 
 	return ret;
@@ -291,8 +291,8 @@ static void ttm_ref_object_release(struct kref *kref)
 		base->ref_obj_release(base, ref->ref_type);
 
 	ttm_base_object_unref(&ref->obj);
-	kfree(ref);
 	ttm_mem_global_free(mem_glob, sizeof(*ref), 0);
+	kfree(ref);
 	write_lock(&tfile->lock);
 }
 
diff --git a/linux-core/ttm/ttm_placement_user.c b/linux-core/ttm/ttm_placement_user.c
index c41b4d79..49695069 100644
--- a/linux-core/ttm/ttm_placement_user.c
+++ b/linux-core/ttm/ttm_placement_user.c
@@ -97,8 +97,8 @@ static void ttm_bo_user_destroy(struct ttm_buffer_object *bo)
 	struct ttm_bo_user_object *user_bo =
 	    container_of(bo, struct ttm_bo_user_object, bo);
 
-	kfree(user_bo);
 	ttm_mem_global_free(bo->bdev->mem_glob, bo->acc_size, 0);
+	kfree(user_bo);
 }
 
 static void ttm_bo_user_release(struct ttm_base_object **p_base)
@@ -176,8 +176,8 @@ int ttm_pl_create_ioctl(struct ttm_object_file *tfile,
 	bo = &user_bo->bo;
 	ret = ttm_read_lock(lock, true);
 	if (unlikely(ret != 0)) {
-		kfree(user_bo);
 		ttm_mem_global_free(mem_glob, acc_size, 0);
+		kfree(user_bo);
 		return ret;
 	}