diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2009-09-10 08:53:04 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-10-05 09:32:05 -0700 |
| commit | 29732ca5d6284c507cefd0b2b76b05b96b3a4f7d (patch) | |
| tree | 29a33a68eee2ac2fbab9846a971446fabebbd492 | |
| parent | 385c165f9edb248473bc442cc2aa8a95e01e8fdb (diff) | |
| download | linux-stable-29732ca5d6284c507cefd0b2b76b05b96b3a4f7d.tar.gz linux-stable-29732ca5d6284c507cefd0b2b76b05b96b3a4f7d.tar.bz2 linux-stable-29732ca5d6284c507cefd0b2b76b05b96b3a4f7d.zip | |
drm/i915: Only destroy a constructed mmap offset
commit 7e61615857c6fb3afbcb43f5c4e97511a923f5a8 upstream.
drm_ht_remove_item() does not handle removing an absent item and the hlist
in particular is incorrectly initialised. The easy remedy is simply skip
calling i915_gem_free_mmap_offset() unless we have actually created the
offset and associated ht entry.
This also fixes the mishandling of a partially constructed offset which
leaves pointers initialized after freeing them along the
i915_gem_create_mmap_offset() error paths.
In particular this should fix the oops found here:
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/415357/comments/8
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 80e5ba490dc2..81cc7ac745a7 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3837,7 +3837,8 @@ void i915_gem_free_object(struct drm_gem_object *obj) i915_gem_object_unbind(obj); - i915_gem_free_mmap_offset(obj); + if (obj_priv->mmap_offset) + i915_gem_free_mmap_offset(obj); kfree(obj_priv->page_cpu_valid); kfree(obj_priv->bit_17); |