From: Joonas Lahtinen joonas.lahtinen@linux.intel.com
[ Upstream commit ebfb6977801da521d8d5d752d373a187e2a2b9b3 ]
Add err goto label and use it when VMA can't be established or changes underneath.
v2: - Dropping Fixes: as it's indeed impossible to race an object to the error address. (Chris) v3: - Use IS_ERR_VALUE (Chris)
Reported-by: Adam Zabrocki adamza@microsoft.com Signed-off-by: Joonas Lahtinen joonas.lahtinen@linux.intel.com Cc: Chris Wilson chris@chris-wilson.co.uk Cc: Tvrtko Ursulin tvrtko.ursulin@linux.intel.com Cc: Adam Zabrocki adamza@microsoft.com Reviewed-by: Tvrtko Ursulin tvrtko.ursulin@intel.com #v2 Reviewed-by: Chris Wilson chris@chris-wilson.co.uk Link: https://patchwork.freedesktop.org/patch/msgid/20190207085454.10598-2-joonas.... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/i915_gem.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index e81abd468a15d..9634d3adb8d01 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -1881,6 +1881,9 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data, addr = vm_mmap(obj->base.filp, 0, args->size, PROT_READ | PROT_WRITE, MAP_SHARED, args->offset); + if (IS_ERR_VALUE(addr)) + goto err; + if (args->flags & I915_MMAP_WC) { struct mm_struct *mm = current->mm; struct vm_area_struct *vma; @@ -1896,17 +1899,22 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data, else addr = -ENOMEM; up_write(&mm->mmap_sem); + if (IS_ERR_VALUE(addr)) + goto err;
/* This may race, but that's ok, it only gets set */ WRITE_ONCE(obj->frontbuffer_ggtt_origin, ORIGIN_CPU); } i915_gem_object_put(obj); - if (IS_ERR((void *)addr)) - return addr;
args->addr_ptr = (uint64_t) addr;
return 0; + +err: + i915_gem_object_put(obj); + + return addr; }
static unsigned int tile_row_pages(struct drm_i915_gem_object *obj)