Bugzilla #3217: Create a new __drm_pci_free which is used internally in

    linux-core to free pci memory without freeing the structure. Linux-core
    internals often create pci dma handle structures on the stack due to
    the lack of a drm_local_map_t to store them in properly. Fix the
    original drm_pci_free to actually free the dma handle structure instead
    of leaking it.
Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>

5 files changed, 19 insertions, 5 deletions

diff --git a/linux-core/drmP.h b/linux-core/drmP.h
index d7a19a2a..720503b6 100644
--- a/linux-core/drmP.h
+++ b/linux-core/drmP.h
@@ -992,6 +992,7 @@ extern int drm_ati_pcigart_cleanup(drm_device_t * dev,
 
 extern drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size,
 			   size_t align, dma_addr_t maxaddr);
+extern void __drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah);
 extern void drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah);
 
 			       /* sysfs support (drm_sysfs.c) */
diff --git a/linux-core/drm_bufs.c b/linux-core/drm_bufs.c
index 66de1f88..a683146f 100644
--- a/linux-core/drm_bufs.c
+++ b/linux-core/drm_bufs.c
@@ -269,6 +269,7 @@ int drm_addmap(struct inode *inode, struct file *filp,
 		}
 		map->handle = dmah->vaddr;
 		map->offset = (unsigned long)dmah->busaddr;
+		kfree(dmah);
 		break;
 	}
 	default:
@@ -380,7 +381,7 @@ int drm_rmmap(struct inode *inode, struct file *filp,
 			dmah.vaddr = map->handle;
 			dmah.busaddr = map->offset;
 			dmah.size = map->size;
-			drm_pci_free(dev, &dmah);
+			__drm_pci_free(dev, &dmah);
 			break;
 		}
 		drm_free(map, sizeof(*map), DRM_MEM_MAPS);
diff --git a/linux-core/drm_drv.c b/linux-core/drm_drv.c
index 28bce225..46f51725 100644
--- a/linux-core/drm_drv.c
+++ b/linux-core/drm_drv.c
@@ -235,7 +235,7 @@ int drm_takedown(drm_device_t * dev)
 					dmah.vaddr = map->handle;
 					dmah.busaddr = map->offset;
 					dmah.size = map->size;
-					drm_pci_free(dev, &dmah);
+					__drm_pci_free(dev, &dmah);
 					break;
 				}
 				drm_free(map, sizeof(*map), DRM_MEM_MAPS);
diff --git a/linux-core/drm_pci.c b/linux-core/drm_pci.c
index 543c7704..dd9b0c8c 100644
--- a/linux-core/drm_pci.c
+++ b/linux-core/drm_pci.c
@@ -122,10 +122,12 @@ drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
 EXPORT_SYMBOL(drm_pci_alloc);
 
 /**
- * \brief Free a PCI consistent memory block.
+ * \brief Free a PCI consistent memory block without freeing its descriptor.
+ *
+ * This function is for internal use in the Linux-specific DRM core code.
  */
 void
-drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah)
+__drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah)
 {
 #if 0
 	unsigned long addr;
@@ -169,6 +171,16 @@ drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah)
 #endif
 
 }
+
+/**
+ * \brief Free a PCI consistent memory block.
+ */
+void
+drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah)
+{
+	__drm_pci_free(dev, dmah);
+	kfree(dmah);
+}
 EXPORT_SYMBOL(drm_pci_free);
 
 /*@}*/
diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c
index bb982b80..67910e6d 100644
--- a/linux-core/drm_vm.c
+++ b/linux-core/drm_vm.c
@@ -242,7 +242,7 @@ void drm_vm_shm_close(struct vm_area_struct *vma)
 				dmah.vaddr = map->handle;
 				dmah.busaddr = map->offset;
 				dmah.size = map->size;
-				drm_pci_free(dev, &dmah);
+				__drm_pci_free(dev, &dmah);
 				break;
 			}
 			drm_free(map, sizeof(*map), DRM_MEM_MAPS);