From 556c62e85f9b97139c1b3f6f1585fcee0bc3eb6a Mon Sep 17 00:00:00 2001 From: Matthew Wilcox Date: Tue, 30 Oct 2018 09:53:51 -0700 Subject: [PATCH] drm/virtio: Handle error from virtio_gpu_resource_id_get ida_alloc() can return -ENOMEM in the highly unlikely case we run out of memory. The current code creates an object with an invalid ID. Signed-off-by: Matthew Wilcox Link: http://patchwork.freedesktop.org/patch/msgid/20181030165352.13065-1-willy@infradead.org Signed-off-by: Gerd Hoffmann --- drivers/gpu/drm/virtio/virtgpu_object.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 77eac4eb06b1..5ac42dded217 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -25,11 +25,16 @@ #include "virtgpu_drv.h" -static void virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, +static int virtio_gpu_resource_id_get(struct virtio_gpu_device *vgdev, uint32_t *resid) { int handle = ida_alloc_min(&vgdev->resource_ida, 1, GFP_KERNEL); + + if (handle < 0) + return handle; + *resid = handle; + return 0; } static void virtio_gpu_resource_id_put(struct virtio_gpu_device *vgdev, uint32_t id) @@ -94,7 +99,11 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, bo = kzalloc(sizeof(struct virtio_gpu_object), GFP_KERNEL); if (bo == NULL) return -ENOMEM; - virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle); + ret = virtio_gpu_resource_id_get(vgdev, &bo->hw_res_handle); + if (ret < 0) { + kfree(bo); + return ret; + } size = roundup(size, PAGE_SIZE); ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); if (ret != 0) { -- 2.11.0