diff options
| author | Matt Atwood <[email protected]> | 2023-02-01 15:28:01 -0800 |
|---|---|---|
| committer | Jani Nikula <[email protected]> | 2023-02-15 17:33:07 +0200 |
| commit | 679caae16175d17467ee1ad1f05dd72d8d4b0973 (patch) | |
| tree | 6e4ca59377cadd09cbec0184291a855cf40f82c2 | |
| parent | fe7f56a7adfbb17bba2454fd97fd97caf9dbddd5 (diff) | |
drm/i915: Fix memory leaks in scatterlist
This patch fixes memory leaks on error escapes in i915_scatterlist.c
Fixes: c3bfba9a2225 ("drm/i915: Check for integer truncation on scatterlist creation")
Cc: Chris Wilson <[email protected]>
Signed-off-by: Matt Atwood <[email protected]>
Reviewed-by: Harish Chegondi <[email protected]>
Signed-off-by: Matt Roper <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
(cherry picked from commit 389b9d91dd57fd2d4428bd0c19ed1cacf2fe918d)
Signed-off-by: Jani Nikula <[email protected]>
| -rw-r--r-- | drivers/gpu/drm/i915/i915_scatterlist.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/i915_scatterlist.c b/drivers/gpu/drm/i915/i915_scatterlist.c index 756289e43dff..7c7a86921b1c 100644 --- a/drivers/gpu/drm/i915/i915_scatterlist.c +++ b/drivers/gpu/drm/i915/i915_scatterlist.c @@ -98,8 +98,10 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, st = &rsgt->table; /* restricted by sg_alloc_table */ if (WARN_ON(overflows_type(DIV_ROUND_UP_ULL(node->size, segment_pages), - unsigned int))) + unsigned int))) { + i915_refct_sgt_put(rsgt); return ERR_PTR(-E2BIG); + } if (sg_alloc_table(st, DIV_ROUND_UP_ULL(node->size, segment_pages), GFP_KERNEL)) { @@ -183,8 +185,10 @@ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, i915_refct_sgt_init(rsgt, size); st = &rsgt->table; /* restricted by sg_alloc_table */ - if (WARN_ON(overflows_type(PFN_UP(res->size), unsigned int))) + if (WARN_ON(overflows_type(PFN_UP(res->size), unsigned int))) { + i915_refct_sgt_put(rsgt); return ERR_PTR(-E2BIG); + } if (sg_alloc_table(st, PFN_UP(res->size), GFP_KERNEL)) { i915_refct_sgt_put(rsgt); |