releases/3.7.4/drm-radeon-fix-a-bogus-kfree.patch

   1 From a6b7e1a02b77ab8fe8775d20a88c53d8ba55482e Mon Sep 17 00:00:00 2001
   2 From: Ilija Hadzic <ihadzic@research.bell-labs.com>
   3 Date: Mon, 7 Jan 2013 18:21:58 -0500
   4 Subject: drm/radeon: fix a bogus kfree
   5
   6 From: Ilija Hadzic <ihadzic@research.bell-labs.com>
   7
   8 commit a6b7e1a02b77ab8fe8775d20a88c53d8ba55482e upstream.
   9
  10 parser->chunks[.].kpage[.] is not always kmalloc-ed
  11 by the parser initialization, so parser_fini should
  12 not try to kfree it if it didn't allocate it.
  13
  14 This patch fixes a kernel oops that can be provoked
  15 in UMS mode.
  16
  17 Signed-off-by: Ilija Hadzic <ihadzic@research.bell-labs.com>
  18 Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
  19 Signed-off-by: Shuah Khan <shuah.khan@hp.com>
  20 Cc: CAI Qian <caiqian@redhat.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 ---
  24  drivers/gpu/drm/radeon/r600_cs.c |    6 ++++--
  25  1 file changed, 4 insertions(+), 2 deletions(-)
  26
  27 --- a/drivers/gpu/drm/radeon/r600_cs.c
  28 +++ b/drivers/gpu/drm/radeon/r600_cs.c
  29 @@ -2429,8 +2429,10 @@ static void r600_cs_parser_fini(struct r
  30         kfree(parser->relocs);
  31         for (i = 0; i < parser->nchunks; i++) {
  32                 kfree(parser->chunks[i].kdata);
  33 -               kfree(parser->chunks[i].kpage[0]);
  34 -               kfree(parser->chunks[i].kpage[1]);
  35 +               if (parser->rdev && (parser->rdev->flags & RADEON_IS_AGP)) {
  36 +                       kfree(parser->chunks[i].kpage[0]);
  37 +                       kfree(parser->chunks[i].kpage[1]);
  38 +               }
  39         }
  40         kfree(parser->chunks);
  41         kfree(parser->chunks_array);