[lkml]   [2009]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[056/136] drm/i915: Only destroy a constructed mmap offset
2.6.31-stable review patch.  If anyone has any objections, please let us know.

From: Chris Wilson <>

commit 7e61615857c6fb3afbcb43f5c4e97511a923f5a8 upstream.

drm_ht_remove_item() does not handle removing an absent item and the hlist
in particular is incorrectly initialised. The easy remedy is simply skip
calling i915_gem_free_mmap_offset() unless we have actually created the
offset and associated ht entry.

This also fixes the mishandling of a partially constructed offset which
leaves pointers initialized after freeing them along the
i915_gem_create_mmap_offset() error paths.

In particular this should fix the oops found here:

Signed-off-by: Chris Wilson <>
Signed-off-by: Eric Anholt <>

drivers/gpu/drm/i915/i915_gem.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3837,7 +3837,8 @@ void i915_gem_free_object(struct drm_gem


- i915_gem_free_mmap_offset(obj);
+ if (obj_priv->mmap_offset)
+ i915_gem_free_mmap_offset(obj);


 \ /
  Last update: 2009-10-02 04:15    [W:0.311 / U:8.544 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site