On Wed, Oct 01, 2014 at 11:54:11AM -0400, Sean Paul wrote:

On Tue, Sep 30, 2014 at 2:48 PM, Sean Paul [off-list ref] wrote:

quoted

On Thu, Jun 26, 2014 at 4:49 PM, Thierry Reding [off-list ref] wrote:

quoted

diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c

[...]

quoted

quoted

 static void tegra_bo_destroy(struct drm_device *drm, struct tegra_bo *bo)
 {
-       dma_free_writecombine(drm->dev, bo->gem.size, bo->vaddr, bo->paddr);
+       if (!bo->pages)
+               dma_free_writecombine(drm->dev, bo->gem.size, bo->vaddr,
+                                     bo->paddr);

One more thing. If tegra_bo_alloc fails, we'll have bo->vaddr == NULL
and bo->paddr == ~0 here, which causes a crash.

I posted https://lkml.org/lkml/2014/9/30/659 to check for the error
condition in the mm code, but it seems like reviewer consensus is to
check for this before calling free.

As such, we'll need to make sure bo->vaddr != NULL before calling
dma_free_writecombine to avoid this situation.

Would you prefer I send a patch up to fix this separately, or would
you like to roll this into your next version?

I've rolled this check into my series because I touch that area of code
anyway.

Thanks for bringing it up.

Thierry
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20141105/8099e49a/attachment.sig>