lkml.org 
[lkml]   [2009]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[056/136] drm/i915: Only destroy a constructed mmap offset
    2.6.31-stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: Chris Wilson <chris@chris-wilson.co.uk>

    commit 7e61615857c6fb3afbcb43f5c4e97511a923f5a8 upstream.

    drm_ht_remove_item() does not handle removing an absent item and the hlist
    in particular is incorrectly initialised. The easy remedy is simply skip
    calling i915_gem_free_mmap_offset() unless we have actually created the
    offset and associated ht entry.

    This also fixes the mishandling of a partially constructed offset which
    leaves pointers initialized after freeing them along the
    i915_gem_create_mmap_offset() error paths.

    In particular this should fix the oops found here:
    https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/415357/comments/8

    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Eric Anholt <eric@anholt.net>

    ---
    drivers/gpu/drm/i915/i915_gem.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/gpu/drm/i915/i915_gem.c
    +++ b/drivers/gpu/drm/i915/i915_gem.c
    @@ -3837,7 +3837,8 @@ void i915_gem_free_object(struct drm_gem

    i915_gem_object_unbind(obj);

    - i915_gem_free_mmap_offset(obj);
    + if (obj_priv->mmap_offset)
    + i915_gem_free_mmap_offset(obj);

    kfree(obj_priv->page_cpu_valid);
    kfree(obj_priv->bit_17);



    \
     
     \ /
      Last update: 2009-10-02 04:15    [W:0.020 / U:1.360 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site