diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2017-01-31 13:46:30 +0300 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2017-01-31 14:15:03 +0300 |
| commit | 4703b0472e126c715019a9671ea0fe38556114bb (patch) | |
| tree | e7b4ff4b480227a5c3cd07e929c0921fd0b2a8d3 /drivers/gpu/drm/i915/i915_gem_internal.c | |
| parent | 9b51b105f2a52a873107d7b28f0aca94e52ad7bd (diff) | |
| download | linux-4703b0472e126c715019a9671ea0fe38556114bb.tar.xz | |
drm/i915: Be defensive when cleaning up i915_gem_internal pages
If we abort the i915_gem_internal get_pages, we mark the failing sg as
the last. However, that means we iterate upto and including the failing
sg element and results in us trying to free the unallocated sg_page().
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/20170131104630.3074-1-chris@chris-wilson.co.uk
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem_internal.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem_internal.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem_internal.c b/drivers/gpu/drm/i915/i915_gem_internal.c index 17ce53d0d092..64d8fb3fd764 100644 --- a/drivers/gpu/drm/i915/i915_gem_internal.c +++ b/drivers/gpu/drm/i915/i915_gem_internal.c @@ -35,8 +35,10 @@ static void internal_free_pages(struct sg_table *st) { struct scatterlist *sg; - for (sg = st->sgl; sg; sg = __sg_next(sg)) - __free_pages(sg_page(sg), get_order(sg->length)); + for (sg = st->sgl; sg; sg = __sg_next(sg)) { + if (sg_page(sg)) + __free_pages(sg_page(sg), get_order(sg->length)); + } sg_free_table(st); kfree(st); @@ -116,6 +118,7 @@ i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj) return st; err: + sg_set_page(sg, NULL, 0, 0); sg_mark_end(sg); internal_free_pages(st); return ERR_PTR(-ENOMEM); |