Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4703b047 authored by Chris Wilson's avatar Chris Wilson
Browse files

drm/i915: Be defensive when cleaning up i915_gem_internal pages 



If we abort the i915_gem_internal get_pages, we mark the failing sg as
the last. However, that means we iterate upto and including the failing
sg element and results in us trying to free the unallocated sg_page().

Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/20170131104630.3074-1-chris@chris-wilson.co.uk


Reviewed-by: default avatarMatthew Auld <matthew.auld@intel.com>
parent 9b51b105

drivers/gpu/drm/i915/i915_gem_internal.c

+5 −2
Original line number Diff line number Diff line
@@ -35,8 +35,10 @@ static void internal_free_pages(struct sg_table *st) 
{

	struct scatterlist *sg;



	for (sg = st->sgl; sg; sg = __sg_next(sg))

	for (sg = st->sgl; sg; sg = __sg_next(sg)) {

		if (sg_page(sg))

			__free_pages(sg_page(sg), get_order(sg->length));

	}



	sg_free_table(st);

	kfree(st);
@@ -116,6 +118,7 @@ i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj) 
	return st;



err:

	sg_set_page(sg, NULL, 0, 0);

	sg_mark_end(sg);

	internal_free_pages(st);

	return ERR_PTR(-ENOMEM);