Commit 54fd4b9a authored by Dan Carpenter's avatar Dan Carpenter Committed by Rodrigo Vivi
Browse files

drm/i915/gem: Fix oops in error handling code 



This code will Oops when it tries to i915_gem_object_free(obj) because
"obj" is an error pointer.

Fixes: 97d55396 ("drm/i915/region: convert object_create into object_init")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/YA6FkPn5S4ZDUGxq@mwanda


(cherry picked from commit ad8db423a30f0ac39a5483dfd726058135ff2bd2)
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent fbb2bdd2

drivers/gpu/drm/i915/gem/i915_gem_stolen.c

+4 −8
Original line number Diff line number Diff line
@@ -753,22 +753,18 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_i915_private *i915, 
	mutex_lock(&i915->mm.stolen_lock);

	ret = drm_mm_reserve_node(&i915->mm.stolen, stolen);

	mutex_unlock(&i915->mm.stolen_lock);

	if (ret) {

		obj = ERR_PTR(ret);

	if (ret)

		goto err_free;

	}



	obj = i915_gem_object_alloc();

	if (!obj) {

		obj = ERR_PTR(-ENOMEM);

		ret = -ENOMEM;

		goto err_stolen;

	}



	ret = __i915_gem_object_create_stolen(mem, obj, stolen);

	if (ret) {

		obj = ERR_PTR(ret);

	if (ret)

		goto err_object_free;

	}



	i915_gem_object_set_cache_coherency(obj, I915_CACHE_NONE);

	return obj;
@@ -779,7 +775,7 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_i915_private *i915, 
	i915_gem_stolen_remove_node(i915, stolen);

err_free:

	kfree(stolen);

	return obj;

	return ERR_PTR(ret);

}



bool i915_gem_object_is_stolen(const struct drm_i915_gem_object *obj)