Check for do_mmap errors

2 files changed, 18 insertions, 4 deletions

diff --git a/linux-core/drm_gem.c b/linux-core/drm_gem.c
index db12f9a6..80d5a350 100644
--- a/linux-core/drm_gem.c
+++ b/linux-core/drm_gem.c
@@ -306,6 +306,7 @@ drm_gem_mmap_ioctl(struct drm_device *dev, void *data,
 	struct drm_gem_mmap *args = data;
 	struct drm_gem_object *obj;
 	loff_t offset;
+	unsigned long addr;
 
 	if (!(dev->driver->driver_features & DRIVER_GEM))
 		return -ENODEV;
@@ -317,12 +318,15 @@ drm_gem_mmap_ioctl(struct drm_device *dev, void *data,
 	offset = args->offset;
 
 	down_write(&current->mm->mmap_sem);
-	args->addr_ptr = (uint64_t) do_mmap(obj->filp, 0, args->size,
-				    PROT_READ | PROT_WRITE, MAP_SHARED,
-				    args->offset);
+	addr = do_mmap(obj->filp, 0, args->size,
+		       PROT_READ | PROT_WRITE, MAP_SHARED,
+		       args->offset);
 	up_write(&current->mm->mmap_sem);
-
 	drm_gem_object_unreference(obj);
+	if (IS_ERR((void *)addr))
+		return (int) addr;
+
+	args->addr_ptr = (uint64_t) addr;
 
 	return 0;
 }
diff --git a/linux-core/i915_gem.c b/linux-core/i915_gem.c
index 747cc45c..e0beeb43 100644
--- a/linux-core/i915_gem.c
+++ b/linux-core/i915_gem.c
@@ -300,12 +300,14 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	/* Big hammer: flush and idle the hardware so we can map things in/out.
 	 */
 	ret = i915_gem_sync_and_evict(dev);
 	if (ret != 0)
 		return ret;
 
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	/* Copy in the validate list from userland */
 	validate_list = drm_calloc(sizeof(*validate_list), args->buffer_count,
 				   DRM_MEM_DRIVER);
@@ -315,6 +317,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 		ret = -ENOMEM;
 		goto err;
 	}
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	ret = copy_from_user(validate_list,
 			     (struct drm_i915_relocation_entry __user*)(uintptr_t)
 			     args->buffers_ptr,
@@ -322,6 +325,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 	if (ret != 0)
 		goto err;
 
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	/* Look up object handles and perform the relocations */
 	for (i = 0; i < args->buffer_count; i++) {
 		object_list[i] = drm_gem_object_lookup(dev, file_priv,
@@ -337,6 +341,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 
 	/* Exec the batchbuffer */
 
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	/* Copy the new buffer offsets back to the user's validate list. */
 	for (i = 0; i < args->buffer_count; i++) {
 		struct drm_i915_gem_object *obj_priv =
@@ -344,24 +349,29 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 
 		validate_list[i].buffer_offset = obj_priv->gtt_offset;
 	}
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	ret = copy_to_user(validate_list,
 			     (struct drm_i915_relocation_entry __user*)(uintptr_t)
 			     args->buffers_ptr,
 			     sizeof(*validate_list) * args->buffer_count);
 
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	/* Clean up and return */
 	ret = i915_gem_sync_and_evict(dev);
 
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 err:
 	if (object_list != NULL) {
 		for (i = 0; i < args->buffer_count; i++)
 			drm_gem_object_unreference(object_list[i]);
 	}
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	drm_free(object_list, sizeof(*object_list) * args->buffer_count,
 		 DRM_MEM_DRIVER);
 	drm_free(validate_list, sizeof(*validate_list) * args->buffer_count,
 		 DRM_MEM_DRIVER);
 
+	DRM_INFO ("%s:%d\n", __FUNCTION__, __LINE__);
 	return ret;
 }