Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93533c29 authored by Chris Wilson's avatar Chris Wilson Committed by Eric Anholt
Browse files

drm/i915: Fix leak of relocs along do_execbuffer error path 



Following a gpu hang, we would leak the relocation buffer. So simply
earrange the error path to always free the relocation buffer.

Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
parent 67026e03

drivers/gpu/drm/i915/i915_gem.c

+5 −2
Original line number Original line Diff line number Diff line
@@ -3584,6 +3584,9 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object2 *exec_list, 
	uint32_t reloc_count = 0, i;

	uint32_t reloc_count = 0, i;

	int ret = 0;

	int ret = 0;





	if (relocs == NULL)

	    return 0;



	for (i = 0; i < buffer_count; i++) {

	for (i = 0; i < buffer_count; i++) {

		struct drm_i915_gem_relocation_entry __user *user_relocs;

		struct drm_i915_gem_relocation_entry __user *user_relocs;

		int unwritten;

		int unwritten;
@@ -3673,7 +3676,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, 
	struct drm_gem_object *batch_obj;

	struct drm_gem_object *batch_obj;

	struct drm_i915_gem_object *obj_priv;

	struct drm_i915_gem_object *obj_priv;

	struct drm_clip_rect *cliprects = NULL;

	struct drm_clip_rect *cliprects = NULL;

	struct drm_i915_gem_relocation_entry *relocs;

	struct drm_i915_gem_relocation_entry *relocs = NULL;

	int ret = 0, ret2, i, pinned = 0;

	int ret = 0, ret2, i, pinned = 0;

	uint64_t exec_offset;

	uint64_t exec_offset;

	uint32_t seqno, flush_domains, reloc_index;

	uint32_t seqno, flush_domains, reloc_index;
@@ -3950,6 +3953,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, 




	mutex_unlock(&dev->struct_mutex);

	mutex_unlock(&dev->struct_mutex);





pre_mutex_err:

	/* Copy the updated relocations out regardless of current error

	/* Copy the updated relocations out regardless of current error

	 * state.  Failure to update the relocs would mean that the next

	 * state.  Failure to update the relocs would mean that the next

	 * time userland calls execbuf, it would do so with presumed offset

	 * time userland calls execbuf, it would do so with presumed offset
@@ -3964,7 +3968,6 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, 
			ret = ret2;

			ret = ret2;

	}

	}





pre_mutex_err:

	drm_free_large(object_list);

	drm_free_large(object_list);

	kfree(cliprects);

	kfree(cliprects);