Commit 4703b047 authored by Chris Wilson's avatar Chris Wilson

drm/i915: Be defensive when cleaning up i915_gem_internal pages

If we abort the i915_gem_internal get_pages, we mark the failing sg as
the last. However, that means we iterate upto and including the failing
sg element and results in us trying to free the unallocated sg_page().
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/20170131104630.3074-1-chris@chris-wilson.co.ukReviewed-by: default avatarMatthew Auld <matthew.auld@intel.com>
parent 9b51b105
...@@ -35,8 +35,10 @@ static void internal_free_pages(struct sg_table *st) ...@@ -35,8 +35,10 @@ static void internal_free_pages(struct sg_table *st)
{ {
struct scatterlist *sg; struct scatterlist *sg;
for (sg = st->sgl; sg; sg = __sg_next(sg)) for (sg = st->sgl; sg; sg = __sg_next(sg)) {
if (sg_page(sg))
__free_pages(sg_page(sg), get_order(sg->length)); __free_pages(sg_page(sg), get_order(sg->length));
}
sg_free_table(st); sg_free_table(st);
kfree(st); kfree(st);
...@@ -116,6 +118,7 @@ i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj) ...@@ -116,6 +118,7 @@ i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
return st; return st;
err: err:
sg_set_page(sg, NULL, 0, 0);
sg_mark_end(sg); sg_mark_end(sg);
internal_free_pages(st); internal_free_pages(st);
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment