Commit 16a5dcf7 authored by Souptick Joarder's avatar Souptick Joarder Committed by Mauro Carvalho Chehab
Browse files

media: atomisp: Fixed error handling path 

Inside alloc_user_pages() based on flag value either pin_user_pages()
or get_user_pages_fast() will be called. However, these API might fail.

But free_user_pages() called in error handling path doesn't bother
about return value and will try to unpin bo->pgnr pages, which is
incorrect.

Fix this by passing the page_nr to free_user_pages(). If page_nr > 0
pages will be unpinned based on bo->mem_type. This will also take care
of non error handling path.

allocation")

Link: https://lore.kernel.org/linux-media/1601219284-13275-1-git-send-email-jrdr.linux@gmail.com


Fixes: 14a638ab ("media: atomisp: use pin_user_pages() for memory
Signed-off-by: default avatarSouptick Joarder <jrdr.linux@gmail.com>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 491a0b20

drivers/staging/media/atomisp/pci/hmm/hmm_bo.c

+8 −5
Original line number Diff line number Diff line
@@ -857,16 +857,17 @@ static void free_private_pages(struct hmm_buffer_object *bo, 
	kfree(bo->page_obj);

}



static void free_user_pages(struct hmm_buffer_object *bo)

static void free_user_pages(struct hmm_buffer_object *bo,

			    unsigned int page_nr)

{

	int i;



	hmm_mem_stat.usr_size -= bo->pgnr;



	if (bo->mem_type == HMM_BO_MEM_TYPE_PFN) {

		unpin_user_pages(bo->pages, bo->pgnr);

		unpin_user_pages(bo->pages, page_nr);

	} else {

		for (i = 0; i < bo->pgnr; i++)

		for (i = 0; i < page_nr; i++)

			put_page(bo->pages[i]);

	}

	kfree(bo->pages);
@@ -942,6 +943,8 @@ static int alloc_user_pages(struct hmm_buffer_object *bo, 
		dev_err(atomisp_dev,

			"get_user_pages err: bo->pgnr = %d, pgnr actually pinned = %d.\n",

			bo->pgnr, page_nr);

		if (page_nr < 0)

			page_nr = 0;

		goto out_of_mem;

	}
@@ -954,7 +957,7 @@ static int alloc_user_pages(struct hmm_buffer_object *bo, 


out_of_mem:



	free_user_pages(bo);

	free_user_pages(bo, page_nr);



	return -ENOMEM;

}
@@ -1037,7 +1040,7 @@ void hmm_bo_free_pages(struct hmm_buffer_object *bo) 
	if (bo->type == HMM_BO_PRIVATE)

		free_private_pages(bo, &dynamic_pool, &reserved_pool);

	else if (bo->type == HMM_BO_USER)

		free_user_pages(bo);

		free_user_pages(bo, bo->pgnr);

	else

		dev_err(atomisp_dev, "invalid buffer type.\n");

	mutex_unlock(&bo->mutex);