diff options
| author | Matthew Wilcox <willy@infradead.org> | 2018-10-30 09:53:51 -0700 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2018-11-14 12:50:34 +0100 |
| commit | 556c62e85f9b97139c1b3f6f1585fcee0bc3eb6a (patch) | |
| tree | 7e954dcef435d0b5b8a1128b81f92cd03f35b597 /drivers/gpu/drm/virtio/virtgpu_object.c | |
| parent | 7db647aa8b134059c3b8f26b1dd2e1aa5b91e2ca (diff) | |
drm/virtio: Handle error from virtio_gpu_resource_id_get
ida_alloc() can return -ENOMEM in the highly unlikely case we run out
of memory. The current code creates an object with an invalid ID.
Signed-off-by: Matthew Wilcox <willy@infradead.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20181030165352.13065-1-willy@infradead.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/virtio/virtgpu_object.c')
| -rw-r--r-- | drivers/gpu/drm/virtio/virtgpu_object.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 77eac4eb06b1..5ac42dded217 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -25,11 +25,16 @@ #include "virtgpu_drv.h" -static void virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, +static int virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, uint32_t *resid) { int handle = ida_alloc_min(&vgdev->resource_ida, 1, GFP_KERNEL); + + if (handle < 0) + return handle; + *resid = handle; + return 0; } static void virtio_gpu_resource_id_put(struct virtio_gpu_device *vgdev, uint32_t id) @@ -94,7 +99,11 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, bo = kzalloc(sizeof(struct virtio_gpu_object), GFP_KERNEL); if (bo == NULL) return -ENOMEM; - virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle); + ret = virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle); + if (ret < 0) { + kfree(bo); + return ret; + } size = roundup(size, PAGE_SIZE); ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); if (ret != 0) { |