drivers/gpu/drm/i915/i915_irq.c:i915_error_object_create(): use correct kmap-atomic...

i915_error_object_create() is called from the timer interrupt and hence
can corrupt the KM_USER0 slot.  Use KM_IRQ0 instead.

Reported-by: Jaswinder Singh Rajput <[email protected]>
Tested-by: Jaswinder Singh Rajput <[email protected]>
Acked-by: Chris Wilson <[email protected]>
Cc: Dave Airlie <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2b8b969d0c15e029731b1bbe03b4adb63a077489..df6a9cd82c4d9a12d455cb2131d66d3fd8e7b1ec 100644 (file)
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -456,11 +456,15 @@ i915_error_object_create(struct drm_device *dev,
 
        for (page = 0; page < page_count; page++) {
                void *s, *d = kmalloc(PAGE_SIZE, GFP_ATOMIC);
+               unsigned long flags;
+
                if (d == NULL)
                        goto unwind;
-               s = kmap_atomic(src_priv->pages[page], KM_USER0);
+               local_irq_save(flags);
+               s = kmap_atomic(src_priv->pages[page], KM_IRQ0);
                memcpy(d, s, PAGE_SIZE);
-               kunmap_atomic(s, KM_USER0);
+               kunmap_atomic(s, KM_IRQ0);
+               local_irq_restore(flags);
                dst->pages[page] = d;
        }
        dst->page_count = page_count;