drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.

If a CMA allocation failed, the partially constructed BO would be unreferenced through the normal path, and we might choose to put it in the BO cache. If we then reused it before it expired from the cache, the kernel would OOPS. Signed-off-by: Eric Anholt <[email protected]> Fixes: c826a6e ("drm/vc4: Add a BO cache.")
raspberrypi · Feb 20, 2017 · b50792d · b50792d
1 parent e0d0263
commit b50792d
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -314,6 +314,14 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
 		goto out;
 	}
 
+	/* If this object was partially constructed but CMA allocation
+	 * had failed, just free it.
+	 */
+	if (!bo->base.vaddr) {
+		vc4_bo_destroy(bo);
+		goto out;
+	}
+
 	cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size);
 	if (!cache_list) {
 		vc4_bo_destroy(bo);