From f92e88343e713c65f6edef4ed7883ba37a8ccbfd Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Mon, 9 May 2011 16:04:45 +0100 Subject: [PATCH] gma500: Fix dumb create crash The error path from gtt_alloc returns NULL not a ptr error. The underlying fail is caused by a bug in the size calculation. With these two fixed it passes kmstest, although it's not really doing anything useful yet. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman --- drivers/staging/gma500/psb_gem.c | 6 +++--- drivers/staging/gma500/psb_gtt.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/staging/gma500/psb_gem.c b/drivers/staging/gma500/psb_gem.c index d47c187f1650..518f8c163464 100644 --- a/drivers/staging/gma500/psb_gem.c +++ b/drivers/staging/gma500/psb_gem.c @@ -100,8 +100,8 @@ static int psb_gem_create(struct drm_file *file, /* Allocate our object - for now a direct gtt range which is not stolen memory backed */ r = psb_gtt_alloc_range(dev, size, "gem", 0); - if (IS_ERR(r)) - return PTR_ERR(r); + if (r == NULL) + return -ENOSPC; /* Initialize the extra goodies GEM needs to do all the hard work */ if (drm_gem_object_init(dev, &r->gem, size) != 0) { psb_gtt_free_range(dev, r); @@ -135,7 +135,7 @@ static int psb_gem_create(struct drm_file *file, int psb_gem_dumb_create(struct drm_file *file, struct drm_device *dev, struct drm_mode_create_dumb *args) { - args->pitch = ALIGN(args->width & ((args->bpp + 1) / 8), 64); + args->pitch = ALIGN(args->width * ((args->bpp + 7) / 8), 64); args->size = args->pitch * args->height; return psb_gem_create(file, dev, args->size, &args->handle); } diff --git a/drivers/staging/gma500/psb_gtt.c b/drivers/staging/gma500/psb_gtt.c index 10d772aa802c..dc0a4b7850d2 100644 --- a/drivers/staging/gma500/psb_gtt.c +++ b/drivers/staging/gma500/psb_gtt.c @@ -277,7 +277,7 @@ struct gtt_range *psb_gtt_alloc_range(struct drm_device *dev, int len, } else { /* The rest we will use for GEM backed objects */ start = r->start + dev_priv->pg->stolen_size; - end = -1; + end = r->end; } gt = kzalloc(sizeof(struct gtt_range), GFP_KERNEL); -- 2.39.5