From patchwork Fri Mar 12 19:52:55 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 85355 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o2CJr4Li007615 for ; Fri, 12 Mar 2010 19:53:41 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B28649E985; Fri, 12 Mar 2010 11:53:02 -0800 (PST) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from orsmga101.jf.intel.com (mga06.intel.com [134.134.136.21]) by gabe.freedesktop.org (Postfix) with ESMTP id D79F29E85E for ; Fri, 12 Mar 2010 11:53:00 -0800 (PST) Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga101.jf.intel.com with ESMTP; 12 Mar 2010 11:49:31 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.49,627,1262592000"; d="scan'208";a="603876309" Received: from unknown (HELO localhost.localdomain) ([10.255.13.113]) by orsmga001.jf.intel.com with ESMTP; 12 Mar 2010 11:52:37 -0800 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Fri, 12 Mar 2010 19:52:55 +0000 Message-Id: <1268423575-10551-1-git-send-email-chris@chris-wilson.co.uk> X-Mailer: git-send-email 1.7.0 Cc: stable@kernel.org Subject: [Intel-gfx] [PATCH] drm/i915: Avoid NULL deref in get_pages() unwind after error. X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Fri, 12 Mar 2010 19:53:46 +0000 (UTC) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 00f8f5c..6dbf352 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -1455,9 +1455,6 @@ i915_gem_object_put_pages(struct drm_gem_object *obj) obj_priv->dirty = 0; for (i = 0; i < page_count; i++) { - if (obj_priv->pages[i] == NULL) - break; - if (obj_priv->dirty) set_page_dirty(obj_priv->pages[i]); @@ -2258,11 +2255,9 @@ i915_gem_object_get_pages(struct drm_gem_object *obj, mapping_gfp_mask (mapping) | __GFP_COLD | gfpmask); - if (IS_ERR(page)) { - obj_priv->pages[i] = NULL; - i915_gem_object_put_pages(obj); - return PTR_ERR(page); - } + if (IS_ERR(page)) + goto err_pages; + obj_priv->pages[i] = page; } @@ -2270,6 +2265,15 @@ i915_gem_object_get_pages(struct drm_gem_object *obj, i915_gem_object_do_bit_17_swizzle(obj); return 0; + +err_pages: + while (i--) + page_cache_release(obj_priv->pages[i]); + + drm_free_large(obj_priv->pages); + obj_priv->pages = NULL; + obj_priv->pages_refcount--; + return PTR_ERR(page); } static void sandybridge_write_fence_reg(struct drm_i915_fence_reg *reg)