diff options
| author | Matthew Auld <matthew.auld@intel.com> | 2021-01-20 10:47:14 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2021-01-20 11:11:24 +0000 |
| commit | 95b98f004f9d9ad240867ddbb7b3eb38a3471828 (patch) | |
| tree | 113871f50ad13abc68041749b6df4052426ad1e6 /drivers/gpu/drm/i915/gem/i915_gem_region.c | |
| parent | 1e58215f06d6dae93e2c312d07ca433b7e5ce80d (diff) | |
| download | linux-95b98f004f9d9ad240867ddbb7b3eb38a3471828.tar.gz | |
drm/i915/region: don't leak the object on error
Sanity check the object size before allocating a new gem object.
Fixes: 97d553963250 ("drm/i915/region: convert object_create into object_init")
Testcase: igt/gem_create/create-massive
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20210120104714.112812-1-matthew.auld@intel.com
Diffstat (limited to 'drivers/gpu/drm/i915/gem/i915_gem_region.c')
| -rw-r--r-- | drivers/gpu/drm/i915/gem/i915_gem_region.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_region.c b/drivers/gpu/drm/i915/gem/i915_gem_region.c index 4834a0b272f4..3e3dad22a683 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_region.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_region.c @@ -161,10 +161,6 @@ i915_gem_object_create_region(struct intel_memory_region *mem, GEM_BUG_ON(!size); GEM_BUG_ON(!IS_ALIGNED(size, I915_GTT_MIN_ALIGNMENT)); - obj = i915_gem_object_alloc(); - if (!obj) - return ERR_PTR(-ENOMEM); - /* * XXX: There is a prevalence of the assumption that we fit the * object's page count inside a 32bit _signed_ variable. Let's document @@ -178,6 +174,10 @@ i915_gem_object_create_region(struct intel_memory_region *mem, if (overflows_type(size, obj->base.size)) return ERR_PTR(-E2BIG); + obj = i915_gem_object_alloc(); + if (!obj) + return ERR_PTR(-ENOMEM); + err = mem->ops->init_object(mem, obj, size, flags); if (err) goto err_object_free; |