Merge "drm/mm: Fix NULL pointer dereference in allocator" (17b25ccf) · Commits · e / devices / android_kernel_sony_msm8998

drivers/gpu/drm/drm_mm.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -541,6 +541,9 @@ static struct drm_mm_node get_first_hole(const struct drm_mm mm,
		if (flags & DRM_MM_SEARCH_BOTTOM_UP) {
		struct rb_node *node = rb_first(&mm->holes_tree);

		if (!node)
		return NULL;

		return rb_entry(node, struct drm_mm_node, hole_node);
		} else if (flags & DRM_MM_SEARCH_BELOW) {
		return list_entry((mm)->hole_stack.prev,
		@@ -555,8 +558,12 @@ static struct drm_mm_node get_next_hole(struct drm_mm_node entry,
		enum drm_mm_search_flags flags)
		{
		if (flags & DRM_MM_SEARCH_BOTTOM_UP) {
		return rb_entry(rb_next(&entry->hole_node),
		struct drm_mm_node, hole_node);
		struct rb_node *node = rb_next(&entry->hole_node);

		if (!node)
		return NULL;

		return rb_entry(node, struct drm_mm_node, hole_node);
		} else if (flags & DRM_MM_SEARCH_BELOW) {
		return list_entry(entry->hole_stack.prev,
		struct drm_mm_node, hole_stack);

+1 −1

Original line number	Diff line number	Diff line
		@@ -585,7 +585,7 @@ int msm_gem_get_iova(struct drm_gem_object *obj,
		obj_remove_domain(domain);

		mutex_unlock(&msm_obj->lock);
		return 0;
		return ret;
		}

		/* get iova without taking a reference, used in places where you have

+1 −1

Original line number	Diff line number	Diff line
		@@ -60,7 +60,7 @@ msm_gem_address_space_new(struct msm_mmu mmu, const char name,

		if (aspace->va_len)
		drm_mm_init(&aspace->mm, (start >> PAGE_SHIFT),
		(end >> PAGE_SHIFT) - 1);
		(aspace->va_len >> PAGE_SHIFT));

		kref_init(&aspace->kref);