diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2020-12-08 03:27:55 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2020-12-08 03:27:55 +0000 |
| commit | ac3fec1d4339cc3bd6f1677055f433274066b951 (patch) | |
| tree | efa9ed1be20617041af924ecde57a49c5dcec571 /sys | |
| parent | d3f07430db8b1f1b27cde0ab13b26c9e3269f3f4 (diff) | |
correct ttm_tt error paths if bus_dmamap_create() fails
Avoids a double free of gtt in amdgpu_ttm_tt_create() if the
bus_dmamap_create() call in ttm_sg_tt_init() fails and ttm_tt_destroy()
calls amdgpu_ttm_backend_destroy().
feedback from and ok kettenis@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/pci/drm/ttm/ttm_tt.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/sys/dev/pci/drm/ttm/ttm_tt.c b/sys/dev/pci/drm/ttm/ttm_tt.c index 0f5954d1d03..de0114e8083 100644 --- a/sys/dev/pci/drm/ttm/ttm_tt.c +++ b/sys/dev/pci/drm/ttm/ttm_tt.c @@ -282,7 +282,9 @@ int ttm_dma_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo, &ttm_dma->map)) { km_free(ttm_dma->segs, round_page(ttm->num_pages * sizeof(bus_dma_segment_t)), &kv_any, &kp_zero); - ttm_tt_destroy(ttm); + kvfree(ttm->pages); + ttm->pages = NULL; + ttm_dma->dma_address = NULL; pr_err("Failed allocating page table\n"); return -ENOMEM; } @@ -322,7 +324,12 @@ int ttm_sg_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo, &ttm_dma->map)) { km_free(ttm_dma->segs, round_page(ttm->num_pages * sizeof(bus_dma_segment_t)), &kv_any, &kp_zero); - ttm_tt_destroy(ttm); + if (ttm->pages) + kvfree(ttm->pages); + else + kvfree(ttm_dma->dma_address); + ttm->pages = NULL; + ttm_dma->dma_address = NULL; pr_err("Failed allocating page table\n"); return -ENOMEM; } |