ida_alloc() can return -ENOMEM in the highly unlikely case we run out of memory. The current code creates an object with an invalid ID.
Signed-off-by: Matthew Wilcox <[email protected]> --- drivers/gpu/drm/virtio/virtgpu_object.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 77eac4eb06b1..5ac42dded217 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -25,11 +25,16 @@ #include "virtgpu_drv.h" -static void virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, +static int virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, uint32_t *resid) { int handle = ida_alloc_min(&vgdev->resource_ida, 1, GFP_KERNEL); + + if (handle < 0) + return handle; + *resid = handle; + return 0; } static void virtio_gpu_resource_id_put(struct virtio_gpu_device *vgdev, uint32_t id) @@ -94,7 +99,11 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, bo = kzalloc(sizeof(struct virtio_gpu_object), GFP_KERNEL); if (bo == NULL) return -ENOMEM; - virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle); + ret = virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle); + if (ret < 0) { + kfree(bo); + return ret; + } size = roundup(size, PAGE_SIZE); ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); if (ret != 0) { -- 2.19.1 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
