Commit b17993b7 authored Nov 14, 2016 by Chris Wilson

drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error



On the DMA mapping error path, sg may be NULL (it has already been
marked as the last scatterlist entry), and we should avoid dereferencing
it again.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: e2273302 ("drm/i915: avoid leaking DMA mappings")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Imre Deak <imre.deak@intel.com>
Cc: stable@vger.kernel.org
Link: http://patchwork.freedesktop.org/patch/msgid/20161114112930.2033-1-chris@chris-wilson.co.uk


Reviewed-by: Matthew Auld <matthew.auld@intel.com>

parent 786d290c

drivers/gpu/drm/i915/i915_gem.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -2386,7 +2386,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
		page = shmem_read_mapping_page(mapping, i);
		if (IS_ERR(page)) {
		ret = PTR_ERR(page);
		goto err_pages;
		goto err_sg;
		}
		}
		if (!i \|\|
		@@ -2419,8 +2419,9 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)

		return st;

		err_pages:
		err_sg:
		sg_mark_end(sg);
		err_pages:
		for_each_sgt_page(page, sgt_iter, st)
		put_page(page);
		sg_free_table(st);