Skip to contentSkip to conversation

drm/nouveau: fix ltcg allocating memory as free

PATCH New Maarten Lankhorst 1 participant 1 message Aug 12, 2013

Subsystems (3)
DRM drivers DRM misc nouveau
lore
Share & tools
lore

Maarten Lankhorst

author
#0 lore raw

PATCH 1/1 drm/nouveau: fix ltcg allocating memory as free

Allocating type=0 marks the memory as free. This allows the ltcg memory to be allocated twice. Add a BUG_ON in core/mm.c to prevent this ever happening again.

Signed-off-by Maarten Lankhorst <[email protected]>

---

drivers/gpu/drm/nouveau/core/core/mm.c +4 -0
index d829172..7a4e089 100644
@@ -98,6 +98,8 @@ nouveau_mm_head(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
 	u32 splitoff;
 	u32 s, e;
 
+	BUG_ON(!type);
+
 	list_for_each_entry(this, &mm->free, fl_entry) {
 		e = this->offset + this->length;
 		s = this->offset;

@@ -162,6 +164,8 @@ nouveau_mm_tail(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
 	struct nouveau_mm_node *prev, *this, *next;
 	u32 mask = align - 1;
 
+	BUG_ON(!type);
+
 	list_for_each_entry_reverse(this, &mm->free, fl_entry) {
 		u32 e = this->offset + this->length;
 		u32 s = this->offset;
drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c +1 -1
index bcca883..7288940 100644
@@ -142,7 +139,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
 	tag_size += tag_align;
 	tag_size  = (tag_size + 0xfff) >> 12; /* round up */
 
-	ret = nouveau_mm_tail(&pfb->vram, 0, tag_size, tag_size, 1,
+	ret = nouveau_mm_tail(&pfb->vram, 1, tag_size, tag_size, 1,
 	                      &priv->tag_ram);
 	if (ret) {
 		priv->num_tags = 0;