video: tegra: host: Fix freeing a ERR_PTR value
Tuomas Tynkkynen [Mon, 20 Aug 2012 14:26:16 +0000 (17:26 +0300)]
nvhost_3dctx_alloc_common correctly checks the return value of an
allocator function, and attempts to perform cleanup. However, this
particular allocation API returns ERR_PTR values in case of failure,
which then gets passed to the deallocation function, causing a crash.

Also, the return value of that allocator API is checked with IS_ERR
in some places, and with IS_ERR_OR_NULL in others. For consistency
and avoiding surprises if the allocation implementation changes,
use IS_ERR_OR_NULL in all places.

Bug 1035878

Change-Id: I65ce97e11f9712b2e9630b38183f6e70bc14b254
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
Reviewed-on: http://git-master/r/124657
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>

drivers/video/tegra/host/gr3d/gr3d.c
drivers/video/tegra/host/gr3d/gr3d_t20.c
drivers/video/tegra/host/gr3d/gr3d_t30.c
drivers/video/tegra/host/mpe/mpe.c

index 7154681..775c77b 100644 (file)
@@ -80,8 +80,10 @@ struct host1x_hwctx *nvhost_3dctx_alloc_common(struct host1x_hwctx_handler *p,
        ctx->restore = mem_op().alloc(memmgr, p->restore_size * 4, 32,
                map_restore ? mem_mgr_flag_write_combine
                            : mem_mgr_flag_uncacheable);
-       if (IS_ERR_OR_NULL(ctx->restore))
+       if (IS_ERR_OR_NULL(ctx->restore)) {
+               ctx->restore = NULL;
                goto fail;
+       }
 
        if (map_restore) {
                ctx->restore_virt = mem_op().mmap(ctx->restore);
index 505674c..694b005 100644 (file)
@@ -371,7 +371,7 @@ struct nvhost_hwctx_handler *nvhost_gr3d_t20_ctxhandler_init(
 
        p->save_buf = mem_op().alloc(memmgr, p->save_size * sizeof(u32), 32,
                                mem_mgr_flag_write_combine);
-       if (IS_ERR(p->save_buf)) {
+       if (IS_ERR_OR_NULL(p->save_buf)) {
                p->save_buf = NULL;
                return NULL;
        }
index 42b4255..664708c 100644 (file)
@@ -409,7 +409,7 @@ struct nvhost_hwctx_handler *nvhost_gr3d_t30_ctxhandler_init(
 
        p->save_buf = mem_op().alloc(memmgr, p->save_size * 4, 32,
                                mem_mgr_flag_write_combine);
-       if (IS_ERR(p->save_buf)) {
+       if (IS_ERR_OR_NULL(p->save_buf)) {
                p->save_buf = NULL;
                return NULL;
        }
index 3b716a0..d76ee01 100644 (file)
@@ -553,7 +553,7 @@ struct nvhost_hwctx_handler *nvhost_mpe_ctxhandler_init(u32 syncpt,
 
        p->save_buf = mem_op().alloc(memmgr, p->save_size * 4, 32,
                                mem_mgr_flag_write_combine);
-       if (IS_ERR(p->save_buf)) {
+       if (IS_ERR_OR_NULL(p->save_buf)) {
                p->save_buf = NULL;
                return NULL;
        }