Patch "drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error" has been added to the 4.8-stable tree

Patch "drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error" has been added to the 4.8-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error

to the 4.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-i915-don-t-touch-null-sg-on-i915_gem_object_get_pages_gtt-error.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 2420489bcb8910188578acc0c11c75445c2e4b92 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Mon, 14 Nov 2016 11:29:30 +0000
Subject: drm/i915: Don't touch NULL sg on i915_gem_object_get_pages_gtt() error

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 2420489bcb8910188578acc0c11c75445c2e4b92 upstream.

On the DMA mapping error path, sg may be NULL (it has already been
marked as the last scatterlist entry), and we should avoid dereferencing
it again.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: e227330223a7 ("drm/i915: avoid leaking DMA mappings")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Imre Deak <imre.deak@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161114112930.2033-1-chris@chris-wilson.co.uk
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
(cherry picked from commit b17993b7b29612369270567643bcff814f4b3d7f)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_gem.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2540,7 +2540,7 @@ i915_gem_object_get_pages_gtt(struct drm
 			page = shmem_read_mapping_page(mapping, i);
 			if (IS_ERR(page)) {
 				ret = PTR_ERR(page);
-				goto err_pages;
+				goto err_sg;
 			}
 		}
 #ifdef CONFIG_SWIOTLB
@@ -2583,8 +2583,9 @@ i915_gem_object_get_pages_gtt(struct drm
 
 	return 0;
 
-err_pages:
+err_sg:
 	sg_mark_end(sg);
+err_pages:
 	for_each_sgt_page(page, sgt_iter, st)
 		put_page(page);
 	sg_free_table(st);


Patches currently in stable-queue which might be from chris@chris-wilson.co.uk are

queue-4.8/drm-i915-don-t-touch-null-sg-on-i915_gem_object_get_pages_gtt-error.patch
queue-4.8/drm-i915-drop-the-struct_mutex-when-wedged-or-trying-to-reset.patch