Unverified Commit 55b0f4a7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Maxime Ripard
Browse files

drm/imagination: fix off by one in pvr_vm_mips_init() error handling 



If the call to vmap() fails the "page_nr" is one element beyond the end
of the mips_data->pt_dma_addr[] and mips_data->pt_pages[] arrays.

The way that this is traditionally written is that we clean up the
partial loop iteration before the goto and then we can say
while (--i >= 0).  At that point we know that all the elements thus
far are initialized so we don't need to have NULL checks.

Fixes: 927f3e02 ("drm/imagination: Implement MIPS firmware processor and MMU support")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarFrank Binns <frank.binns@imgtec.com>
Signed-off-by: default avatarMaxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/a2d3210b-290f-4397-9c3e-efdcca94d8ac@moroto.mountain
parent 9ee33dc4

drivers/gpu/drm/imagination/pvr_vm_mips.c

+5 −6
Original line number Diff line number Diff line
@@ -57,6 +57,7 @@ pvr_vm_mips_init(struct pvr_device *pvr_dev) 
							       PAGE_SIZE, DMA_TO_DEVICE);

		if (dma_mapping_error(dev, mips_data->pt_dma_addr[page_nr])) {

			err = -ENOMEM;

			__free_page(mips_data->pt_pages[page_nr]);

			goto err_free_pages;

		}

	}
@@ -79,12 +80,10 @@ pvr_vm_mips_init(struct pvr_device *pvr_dev) 
	return 0;



err_free_pages:

	for (; page_nr >= 0; page_nr--) {

		if (mips_data->pt_dma_addr[page_nr])

	while (--page_nr >= 0) {

		dma_unmap_page(from_pvr_device(pvr_dev)->dev,

			       mips_data->pt_dma_addr[page_nr], PAGE_SIZE, DMA_TO_DEVICE);



		if (mips_data->pt_pages[page_nr])

		__free_page(mips_data->pt_pages[page_nr]);

	}