Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753256AbcLGHNm (ORCPT ); Wed, 7 Dec 2016 02:13:42 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:58262 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932268AbcLGHJW (ORCPT ); Wed, 7 Dec 2016 02:09:22 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Chris Wilson , Imre Deak , Matthew Auld , Jani Nikula Subject: [PATCH 4.8 20/35] drm/i915: Dont touch NULL sg on i915_gem_object_get_pages_gtt() error Date: Wed, 7 Dec 2016 08:08:36 +0100 Message-Id: <20161207070723.507286694@linuxfoundation.org> X-Mailer: git-send-email 2.10.2 In-Reply-To: <20161207070722.410336250@linuxfoundation.org> References: <20161207070722.410336250@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1515 Lines: 49 4.8-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Wilson commit 2420489bcb8910188578acc0c11c75445c2e4b92 upstream. On the DMA mapping error path, sg may be NULL (it has already been marked as the last scatterlist entry), and we should avoid dereferencing it again. Reported-by: Dan Carpenter Fixes: e227330223a7 ("drm/i915: avoid leaking DMA mappings") Signed-off-by: Chris Wilson Cc: Imre Deak Link: http://patchwork.freedesktop.org/patch/msgid/20161114112930.2033-1-chris@chris-wilson.co.uk Reviewed-by: Matthew Auld (cherry picked from commit b17993b7b29612369270567643bcff814f4b3d7f) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/i915_gem.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2540,7 +2540,7 @@ i915_gem_object_get_pages_gtt(struct drm page = shmem_read_mapping_page(mapping, i); if (IS_ERR(page)) { ret = PTR_ERR(page); - goto err_pages; + goto err_sg; } } #ifdef CONFIG_SWIOTLB @@ -2583,8 +2583,9 @@ i915_gem_object_get_pages_gtt(struct drm return 0; -err_pages: +err_sg: sg_mark_end(sg); +err_pages: for_each_sgt_page(page, sgt_iter, st) put_page(page); sg_free_table(st);