Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2420489b authored by Chris Wilson's avatar Chris Wilson Committed by Jani Nikula
Browse files

drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error 



On the DMA mapping error path, sg may be NULL (it has already been
marked as the last scatterlist entry), and we should avoid dereferencing
it again.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Fixes: e2273302 ("drm/i915: avoid leaking DMA mappings")
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Imre Deak <imre.deak@intel.com>
Cc: stable@vger.kernel.org
Link: http://patchwork.freedesktop.org/patch/msgid/20161114112930.2033-1-chris@chris-wilson.co.uk


Reviewed-by: default avatarMatthew Auld <matthew.auld@intel.com>
(cherry picked from commit b17993b7)
Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
parent e5517c2a

drivers/gpu/drm/i915/i915_gem.c

+3 −2
Original line number Diff line number Diff line
@@ -2268,7 +2268,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) 
			page = shmem_read_mapping_page(mapping, i);

			if (IS_ERR(page)) {

				ret = PTR_ERR(page);

				goto err_pages;

				goto err_sg;

			}

		}

#ifdef CONFIG_SWIOTLB
@@ -2311,8 +2311,9 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) 


	return 0;



err_pages:

err_sg:

	sg_mark_end(sg);

err_pages:

	for_each_sgt_page(page, sgt_iter, st)

		put_page(page);

	sg_free_table(st);