From 280f2542b45d34bc162805e38a28ea357c4310f3 Mon Sep 17 00:00:00 2001 From: Daniel Vetter Date: Mon, 20 Jan 2014 08:21:54 +0100 Subject: [PATCH] drm/gem: Always initialize the gem object in object_init At least drm/i915 expects that the obj->dev pointer is set even in failure paths. Specifically when the shmem initialization fails we call i915_gem_object_free which needs to deref obj->base.dev to get at the slab pointer in the device private structure. And the shmem allocation can easily fail when userspace is hitting open file limits. Doing the structure init even when the shmem file allocation fails prevents this Oops. This is a regression from commit 0f7dafd3aca9ab37e28e2f77206b823d33d97087 Author: David Herrmann Date: Thu Jul 11 11:56:32 2013 +0200 drm/gem: simplify object initialization v2: Add regression note which Chris supplied. Testcase: igt/gem_fd_exhaustion Reported-and-Suggested-by: Linus Torvalds Cc: Linus Torvalds References: http://lists.freedesktop.org/archives/intel-gfx/2014-January/038433.html Cc: stable@vger.kernel.org Reviewed-by: David Herrmann Cc: David Herrmann Signed-off-by: Daniel Vetter --- drivers/gpu/drm/drm_gem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index bed5c3bfed762..5bbad873c798a 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -128,11 +128,12 @@ int drm_gem_object_init(struct drm_device *dev, { struct file *filp; + drm_gem_private_object_init(dev, obj, size); + filp = shmem_file_setup("drm mm object", size, VM_NORESERVE); if (IS_ERR(filp)) return PTR_ERR(filp); - drm_gem_private_object_init(dev, obj, size); obj->filp = filp; return 0; -- 2.39.5