drm/i915: Be defensive when cleaning up i915_gem_internal pages
If we abort the i915_gem_internal get_pages, we mark the failing sg as the last. However, that means we iterate upto and including the failing sg element and results in us trying to free the unallocated sg_page(). Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Link: http://patchwork.freedesktop.org/patch/msgid/20170131104630.3074-1-chris@chris-wilson.co.uk Reviewed-by: Matthew Auld <matthew.auld@intel.com>
This commit is contained in:
parent
9b51b105f2
commit
4703b0472e
|
@ -35,8 +35,10 @@ static void internal_free_pages(struct sg_table *st)
|
|||
{
|
||||
struct scatterlist *sg;
|
||||
|
||||
for (sg = st->sgl; sg; sg = __sg_next(sg))
|
||||
__free_pages(sg_page(sg), get_order(sg->length));
|
||||
for (sg = st->sgl; sg; sg = __sg_next(sg)) {
|
||||
if (sg_page(sg))
|
||||
__free_pages(sg_page(sg), get_order(sg->length));
|
||||
}
|
||||
|
||||
sg_free_table(st);
|
||||
kfree(st);
|
||||
|
@ -116,6 +118,7 @@ i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
|
|||
return st;
|
||||
|
||||
err:
|
||||
sg_set_page(sg, NULL, 0, 0);
|
||||
sg_mark_end(sg);
|
||||
internal_free_pages(st);
|
||||
return ERR_PTR(-ENOMEM);
|
||||
|
|
Loading…
Reference in New Issue