Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18902bbf authored by Maarten Lankhorst's avatar Maarten Lankhorst Committed by Ben Skeggs
Browse files

drm/nouveau/ltcg: fix allocating memory as free 



Allocating type=0 marks the memory as free. This allows the ltcg memory
to be allocated twice.

Add a BUG_ON in core/mm.c to prevent this ever happening again.

Signed-off-by: default avatarMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 52f9a4d7

drivers/gpu/drm/nouveau/core/core/mm.c

+4 −0
Original line number Diff line number Diff line
@@ -98,6 +98,8 @@ nouveau_mm_head(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min, 
	u32 splitoff;

	u32 s, e;



	BUG_ON(!type);



	list_for_each_entry(this, &mm->free, fl_entry) {

		e = this->offset + this->length;

		s = this->offset;
@@ -162,6 +164,8 @@ nouveau_mm_tail(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min, 
	struct nouveau_mm_node *prev, *this, *next;

	u32 mask = align - 1;



	BUG_ON(!type);



	list_for_each_entry_reverse(this, &mm->free, fl_entry) {

		u32 e = this->offset + this->length;

		u32 s = this->offset;

drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c

+1 −1
Original line number Diff line number Diff line
@@ -139,7 +139,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv) 
	tag_size += tag_align;

	tag_size  = (tag_size + 0xfff) >> 12; /* round up */



	ret = nouveau_mm_tail(&pfb->vram, 0, tag_size, tag_size, 1,

	ret = nouveau_mm_tail(&pfb->vram, 1, tag_size, tag_size, 1,

	                      &priv->tag_ram);

	if (ret) {

		priv->num_tags = 0;