| commit | 7e61615857c6fb3afbcb43f5c4e97511a923f5a8 | |
| author | Chris Wilson <chris@chris-wilson.co.uk> | |
| Thu, 10 Sep 2009 07:53:04 +0000 (10 08:53 +0100) | ||
| committer | Eric Anholt <eric@anholt.net> | |
| Fri, 11 Sep 2009 18:40:39 +0000 (11 11:40 -0700) | ||
| tree | a837ceb558c806ea68314b34a41c1685d15bc1ee | treesnapshot (tar.gz zip) |
| parent | e517a5e97080bbe52857bd0d7df9b66602d53c4d | commitdiff |
drm/i915: Only destroy a constructed mmap offset
drm_ht_remove_item() does not handle removing an absent item and the hlist
in particular is incorrectly initialised. The easy remedy is simply skip
calling i915_gem_free_mmap_offset() unless we have actually created the
offset and associated ht entry.
This also fixes the mishandling of a partially constructed offset which
leaves pointers initialized after freeing them along the
i915_gem_create_mmap_offset() error paths.
In particular this should fix the oops found here:
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/415357/comments/8
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
Cc: stable@kernel.org
drm_ht_remove_item() does not handle removing an absent item and the hlist
in particular is incorrectly initialised. The easy remedy is simply skip
calling i915_gem_free_mmap_offset() unless we have actually created the
offset and associated ht entry.
This also fixes the mishandling of a partially constructed offset which
leaves pointers initialized after freeing them along the
i915_gem_create_mmap_offset() error paths.
In particular this should fix the oops found here:
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/415357/comments/8
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
Cc: stable@kernel.org
| drivers/gpu/drm/i915/i915_gem.c | diffblobblamehistory |