gpu: nvgpu: Fixes in dupe free

gr_gk20a.c : railgating path the crash was seen
 with multiple frees happening
acr_gm20b.c : failure path, kernel panic was seen,
 with multiple frees

Change-Id: Ifc5e78c0ee74799c7f78e6030c02d1a27d545a1e
Signed-off-by: Supriya <ssharatkumar@nvidia.com>
Reviewed-on: http://git-master/r/494161
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Tested-by: Terje Bergstrom <tbergstrom@nvidia.com>

2 files changed, 12 insertions, 5 deletions

diff --git a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c
index 661a2ca3..69fe4901 100644
--- a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c
@@ -2269,7 +2269,10 @@ static void gk20a_gr_destroy_ctx_buffer(struct platform_device *pdev,
                                         struct gr_ctx_buffer_desc *desc)
 {
         struct device *dev = &pdev->dev;
-        gk20a_free_sgtable(&desc->sgt);
+        if (!desc)
+                return;
+        if (desc->sgt)
+                gk20a_free_sgtable(&desc->sgt);
         dma_free_attrs(dev, desc->size, desc->pages,
                        desc->iova, &desc->attrs);
 }
diff --git a/drivers/gpu/nvgpu/gm20b/acr_gm20b.c b/drivers/gpu/nvgpu/gm20b/acr_gm20b.c
index ac88b650..3df2f9c5 100644
--- a/drivers/gpu/nvgpu/gm20b/acr_gm20b.c
+++ b/drivers/gpu/nvgpu/gm20b/acr_gm20b.c
@@ -836,7 +836,7 @@ int gm20b_bootstrap_hs_flcn(struct gk20a *g)
         struct vm_gk20a *vm = &mm->pmu.vm;
         struct device *d = dev_from_gk20a(g);
         int i, err = 0;
-        struct sg_table *sgt_pmu_ucode;
+        struct sg_table *sgt_pmu_ucode = NULL;
         dma_addr_t iova;
         u64 *pacr_ucode_cpuva = NULL, pacr_ucode_pmu_va, *acr_dmem;
         u32 img_size_in_bytes;
@@ -952,6 +952,7 @@ int gm20b_bootstrap_hs_flcn(struct gk20a *g)
                         ((acr_ucode_header_t210_load[2]) >> 8);
                 bl_dmem_desc->data_size = acr_ucode_header_t210_load[3];
                 gk20a_free_sgtable(&sgt_pmu_ucode);
+                sgt_pmu_ucode = NULL;
         }
         status = pmu_exec_gen_bl(g, bl_dmem_desc, 1);
         if (status != 0) {
@@ -964,7 +965,8 @@ err_free_ucode_map:
                         img_size_in_bytes, gk20a_mem_flag_none);
         acr->acr_ucode.pmu_va = 0;
 err_free_ucode_sgt:
-        gk20a_free_sgtable(&sgt_pmu_ucode);
+        if (sgt_pmu_ucode)
+                gk20a_free_sgtable(&sgt_pmu_ucode);
 err_free_acr_buf:
         dma_free_coherent(d, img_size_in_bytes,
                         pacr_ucode_cpuva, iova);
@@ -1137,7 +1139,7 @@ int pmu_exec_gen_bl(struct gk20a *g, void *desc, u8 b_wait_for_halt)
         struct vm_gk20a *vm = &mm->pmu.vm;
         struct device *d = dev_from_gk20a(g);
         int i, err = 0;
-        struct sg_table *sgt_pmu_ucode;
+        struct sg_table *sgt_pmu_ucode = NULL;
         dma_addr_t iova;
         u32 bl_sz;
         void *bl_cpuva;
@@ -1208,6 +1210,7 @@ int pmu_exec_gen_bl(struct gk20a *g, void *desc, u8 b_wait_for_halt)
                         gk20a_mem_wr32(bl_cpuva, i, pmu_bl_gm10x[i]);
                 gm20b_dbg_pmu("Copied bl ucode to bl_cpuva\n");
                 gk20a_free_sgtable(&sgt_pmu_ucode);
+                sgt_pmu_ucode = NULL;
         }
         /*
          * Disable interrupts to avoid kernel hitting breakpoint due
@@ -1245,7 +1248,8 @@ err_unmap_bl:
         gk20a_gmmu_unmap(vm, acr->hsbl_ucode.pmu_va,
                         acr->hsbl_ucode.size, gk20a_mem_flag_none);
 err_free_ucode_sgt:
-        gk20a_free_sgtable(&sgt_pmu_ucode);
+        if (sgt_pmu_ucode)
+                gk20a_free_sgtable(&sgt_pmu_ucode);
 err_free_cpu_va:
         dma_free_attrs(d, acr->hsbl_ucode.size,
                         acr->hsbl_ucode.cpuva, acr->hsbl_ucode.iova, &attrs);