target/linux/brcm2708/patches-4.4/0587-drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-.patch

   1 From 73042261439a2d73e4e7b711de55a8a135725739 Mon Sep 17 00:00:00 2001
   2 From: Eric Anholt <eric@anholt.net>
   3 Date: Thu, 9 Feb 2017 09:23:34 -0800
   4 Subject: [PATCH] drm/vc4: Fix OOPSes from trying to cache a partially
   5  constructed BO.
   6
   7 If a CMA allocation failed, the partially constructed BO would be
   8 unreferenced through the normal path, and we might choose to put it in
   9 the BO cache.  If we then reused it before it expired from the cache,
  10 the kernel would OOPS.
  11
  12 Signed-off-by: Eric Anholt <eric@anholt.net>
  13 Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.")
  14 ---
  15  drivers/gpu/drm/vc4/vc4_bo.c | 8 ++++++++
  16  1 file changed, 8 insertions(+)
  17
  18 diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
  19 index ce8a5fd..d7474dd 100644
  20 --- a/drivers/gpu/drm/vc4/vc4_bo.c
  21 +++ b/drivers/gpu/drm/vc4/vc4_bo.c
  22 @@ -334,6 +334,14 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
  23                 goto out;
  24         }
  25
  26 +       /* If this object was partially constructed but CMA allocation
  27 +        * had failed, just free it.
  28 +        */
  29 +       if (!bo->base.vaddr) {
  30 +               vc4_bo_destroy(bo);
  31 +               goto out;
  32 +       }
  33 +
  34         cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size);
  35         if (!cache_list) {
  36                 vc4_bo_destroy(bo);
  37 --
  38 2.1.4
  39