1 files changed, 20 insertions, 7 deletions

diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 487242fb3fdc..f32b71238c03 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -579,18 +579,31 @@ nouveau_gem_pushbuf_validate(struct nouveau_channel *chan,
         return 0;
 }
 
+static inline void
+u_free(void *addr)
+{
+        if (!is_vmalloc_addr(addr))
+                kfree(addr);
+        else
+                vfree(addr);
+}
+
 static inline void *
 u_memcpya(uint64_t user, unsigned nmemb, unsigned size)
 {
         void *mem;
         void __user *userptr = (void __force __user *)(uintptr_t)user;
 
-        mem = kmalloc(nmemb * size, GFP_KERNEL);
+        size *= nmemb;
+
+        mem = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        if (!mem)
+                mem = vmalloc(size);
         if (!mem)
                 return ERR_PTR(-ENOMEM);
 
-        if (DRM_COPY_FROM_USER(mem, userptr, nmemb * size)) {
-                kfree(mem);
+        if (DRM_COPY_FROM_USER(mem, userptr, size)) {
+                u_free(mem);
                 return ERR_PTR(-EFAULT);
         }
 
@@ -676,7 +689,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
                 nouveau_bo_wr32(nvbo, r->reloc_bo_offset >> 2, data);
         }
 
-        kfree(reloc);
+        u_free(reloc);
         return ret;
 }
 
@@ -738,7 +751,7 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
 
         bo = u_memcpya(req->buffers, req->nr_buffers, sizeof(*bo));
         if (IS_ERR(bo)) {
-                kfree(push);
+                u_free(push);
                 return nouveau_abi16_put(abi16, PTR_ERR(bo));
         }
 
@@ -849,8 +862,8 @@ out:
         nouveau_fence_unref(&fence);
 
 out_prevalid:
-        kfree(bo);
-        kfree(push);
+        u_free(bo);
+        u_free(push);
 
 out_next:
         if (chan->dma.ib_max) {