diff mbox

[3/3] drm/tegra: gem: Check before freeing CMA memory

Message ID 1415289436-14797-3-git-send-email-thierry.reding@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Thierry Reding Nov. 6, 2014, 3:57 p.m. UTC 
From: Thierry Reding <treding@nvidia.com>

dma_free_writecombine() must not be called on a buffer that couldn't be
allocated. Check for a valid virtual address before attempting to free
the memory to avoid a crash.

Reported-by: Sean Paul <seanpaul@google.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
---
 drivers/gpu/drm/tegra/gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Sean Paul Nov. 6, 2014, 7:11 p.m. UTC | #1 
On Thu, Nov 6, 2014 at 10:57 AM, Thierry Reding
<thierry.reding@gmail.com> wrote:
> From: Thierry Reding <treding@nvidia.com>
>
> dma_free_writecombine() must not be called on a buffer that couldn't be
> allocated. Check for a valid virtual address before attempting to free
> the memory to avoid a crash.
>
> Reported-by: Sean Paul <seanpaul@google.com>

nit: I'd prefer to use seanpaul@chromium.org instead of my google.com address


> Signed-off-by: Thierry Reding <treding@nvidia.com>

Reviewed-by: Sean Paul <seanpaul@chromium.org>

> ---
>  drivers/gpu/drm/tegra/gem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
> index 4a4f967c6397..da32086cbeaf 100644
> --- a/drivers/gpu/drm/tegra/gem.c
> +++ b/drivers/gpu/drm/tegra/gem.c
> @@ -210,7 +210,7 @@ static void tegra_bo_free(struct drm_device *drm, struct tegra_bo *bo)
>                 drm_gem_put_pages(&bo->gem, bo->pages, true, true);
>                 sg_free_table(bo->sgt);
>                 kfree(bo->sgt);
> -       } else {
> +       } else if (bo->vaddr) {
>                 dma_free_writecombine(drm->dev, bo->gem.size, bo->vaddr,
>                                       bo->paddr);
>         }
> --
> 2.1.3
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
diff mbox

Patch

diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index 4a4f967c6397..da32086cbeaf 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -210,7 +210,7 @@  static void tegra_bo_free(struct drm_device *drm, struct tegra_bo *bo)
 		drm_gem_put_pages(&bo->gem, bo->pages, true, true);
 		sg_free_table(bo->sgt);
 		kfree(bo->sgt);
-	} else {
+	} else if (bo->vaddr) {
 		dma_free_writecombine(drm->dev, bo->gem.size, bo->vaddr,
 				      bo->paddr);
 	}