Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0165de98 authored by Christian König's avatar Christian König Committed by Alex Deucher
Browse files

drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk 



Slowly leaking memory one page at a time :)

Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
Reviewed-by: default avatarAndrey Grodzovsky <andrey.grodzovsky@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 3a74987b

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

+15 −8
Original line number Original line Diff line number Diff line
@@ -39,6 +39,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, 
{

{

	struct drm_gem_object *gobj;

	struct drm_gem_object *gobj;

	unsigned long size;

	unsigned long size;

	int r;





	gobj = drm_gem_object_lookup(p->filp, data->handle);

	gobj = drm_gem_object_lookup(p->filp, data->handle);

	if (gobj == NULL)

	if (gobj == NULL)
@@ -50,20 +51,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, 
	p->uf_entry.tv.shared = true;

	p->uf_entry.tv.shared = true;

	p->uf_entry.user_pages = NULL;

	p->uf_entry.user_pages = NULL;





	size = amdgpu_bo_size(p->uf_entry.robj);

	if (size != PAGE_SIZE || (data->offset + 8) > size)

		return -EINVAL;



	*offset = data->offset;



	drm_gem_object_put_unlocked(gobj);

	drm_gem_object_put_unlocked(gobj);





	size = amdgpu_bo_size(p->uf_entry.robj);

	if (size != PAGE_SIZE || (data->offset + 8) > size) {

		r = -EINVAL;

		goto error_unref;

	}



	if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {

	if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {

		amdgpu_bo_unref(&p->uf_entry.robj);

		r = -EINVAL;

		return -EINVAL;

		goto error_unref;

	}

	}





	*offset = data->offset;



	return 0;

	return 0;



error_unref:

	amdgpu_bo_unref(&p->uf_entry.robj);

	return r;

}

}





static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p,

static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p,