drm/nouveau/ltcg: fix allocating memory as free
authorMaarten Lankhorst <maarten.lankhorst@canonical.com>
Mon, 12 Aug 2013 10:41:34 +0000 (12:41 +0200)
committerBen Skeggs <bskeggs@redhat.com>
Wed, 21 Aug 2013 01:35:53 +0000 (11:35 +1000)
Allocating type=0 marks the memory as free. This allows the ltcg memory
to be allocated twice.

Add a BUG_ON in core/mm.c to prevent this ever happening again.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drivers/gpu/drm/nouveau/core/core/mm.c
drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c

index d8291724dbd47d53ff6edc48a12ad669e5c68d8c..7a4e0891c5f872e0dbda7dc5164b348aa59058c7 100644 (file)
@@ -98,6 +98,8 @@ nouveau_mm_head(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
        u32 splitoff;
        u32 s, e;
 
+       BUG_ON(!type);
+
        list_for_each_entry(this, &mm->free, fl_entry) {
                e = this->offset + this->length;
                s = this->offset;
@@ -162,6 +164,8 @@ nouveau_mm_tail(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
        struct nouveau_mm_node *prev, *this, *next;
        u32 mask = align - 1;
 
+       BUG_ON(!type);
+
        list_for_each_entry_reverse(this, &mm->free, fl_entry) {
                u32 e = this->offset + this->length;
                u32 s = this->offset;
index ee2a0beef5e6d50e3b41007f5bc7f8cc02c5046b..cce65cc565145cb74fdfd513967cb5723c1afc8d 100644 (file)
@@ -139,7 +139,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
        tag_size += tag_align;
        tag_size  = (tag_size + 0xfff) >> 12; /* round up */
 
-       ret = nouveau_mm_tail(&pfb->vram, 0, tag_size, tag_size, 1,
+       ret = nouveau_mm_tail(&pfb->vram, 1, tag_size, tag_size, 1,
                              &priv->tag_ram);
        if (ret) {
                priv->num_tags = 0;