[PATCH] drm/ttm: properly unmap dma page upon failure

[Yu Zhao]

dma_unmap_page() must be called with exactly the same dma address
and size returned by dma_map_page(). Otherwise, the function may
fail.

This is at least the case for debug_dma_unmap_page() and AMD iommu
unmap_page callback.

Signed-off-by: Yu Zhao <yuzhao@xxxxxxxxxx>
---
 drivers/gpu/drm/ttm/ttm_page_alloc.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index f841accc2c00..c1636595f63c 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -1118,10 +1118,19 @@ int ttm_populate_and_map_pages(struct device *dev, struct ttm_dma_tt *tt,
 						  0, num_pages * PAGE_SIZE,
 						  DMA_BIDIRECTIONAL);
 		if (dma_mapping_error(dev, tt->dma_address[i])) {
+			num_pages = 1;
 			while (i--) {
+				if (i && tt->ttm.pages[i] -
+					 tt->ttm.pages[i - 1] == 1) {
+					tt->dma_address[i] = 0;
+					num_pages++;
+					continue;
+				}
 				dma_unmap_page(dev, tt->dma_address[i],
-					       PAGE_SIZE, DMA_BIDIRECTIONAL);
+					       num_pages * PAGE_SIZE,
+					       DMA_BIDIRECTIONAL);
 				tt->dma_address[i] = 0;
+				num_pages = 1;
 			}
 			ttm_pool_unpopulate(&tt->ttm);
 			return -EFAULT;
-- 
2.21.0.392.gf8f6787159e-goog