drm/virtio: Handle error from virtio_gpu_resource_id_get

ida_alloc() can return -ENOMEM in the highly unlikely case we run out
of memory.  The current code creates an object with an invalid ID.

Signed-off-by: Matthew Wilcox <willy@infradead.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20181030165352.13065-1-willy@infradead.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
index 77eac4e..5ac42dd 100644 (file)
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -25,11 +25,16 @@
 
 #include "virtgpu_drv.h"
 
-static void virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev,
+static int virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev,
                                       uint32_t *resid)
 {
        int handle = ida_alloc_min(&vgdev->resource_ida, 1, GFP_KERNEL);
+
+       if (handle < 0)
+               return handle;
+
        *resid = handle;
+       return 0;
 }
 
 static void virtio_gpu_resource_id_put(struct virtio_gpu_device *vgdev, uint32_t id)
@@ -94,7 +99,11 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev,
        bo = kzalloc(sizeof(struct virtio_gpu_object), GFP_KERNEL);
        if (bo == NULL)
                return -ENOMEM;
-       virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle);
+       ret = virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle);
+       if (ret < 0) {
+               kfree(bo);
+               return ret;
+       }
        size = roundup(size, PAGE_SIZE);
        ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size);
        if (ret != 0) {