added return -EINVAL in drm_dma_enqueue()

1 files changed, 16 insertions, 6 deletions

diff --git a/xc/programs/Xserver/hw/xfree86/os-support/linux/drm/kernel/dma.c b/xc/programs/Xserver/hw/xfree86/os-support/linux/drm/kernel/dma.c
index 8291e52e4..01bd49d38 100644
--- a/xc/programs/Xserver/hw/xfree86/os-support/linux/drm/kernel/dma.c
+++ b/xc/programs/Xserver/hw/xfree86/os-support/linux/drm/kernel/dma.c
@@ -63,15 +63,24 @@ void drm_dma_takedown(drm_device_t *dev)
 					       dma->bufs[i].page_order,
 					       DRM_MEM_DMA);
 			}
-			drm_free(dma->bufs[i].buflist,
-				 dma->buf_count
-				 * sizeof(*dma->bufs[0].buflist),
-				 DRM_MEM_BUFS);
 			drm_free(dma->bufs[i].seglist,
-				 dma->buf_count
+				 dma->bufs[i].seg_count
 				 * sizeof(*dma->bufs[0].seglist),
 				 DRM_MEM_SEGS);
-			drm_freelist_destroy(&dma->bufs[i].freelist);
+		}
+	   	if(dma->bufs[i].buf_count) {
+		   	for(j = 0; j < dma->bufs[i].buf_count; j++) {
+			   if(dma->bufs[i].buflist[j].dev_private) {
+			      drm_free(dma->bufs[i].buflist[j].dev_private,
+				       dma->bufs[i].buflist[j].dev_priv_size,
+				       DRM_MEM_BUFS);
+			   }
+			}
+		   	drm_free(dma->bufs[i].buflist,
+				 dma->bufs[i].buf_count *
+				 sizeof(*dma->bufs[0].buflist),
+				 DRM_MEM_BUFS);
+		   	drm_freelist_destroy(&dma->bufs[i].freelist);
 		}
 	}
 	
@@ -422,6 +431,7 @@ int drm_dma_enqueue(drm_device_t *dev, drm_dma_t *d)
 			atomic_dec(&q->use_count);
 			DRM_ERROR("Process %d using buffer %d on list %d\n",
 				  current->pid, buf->idx, buf->list);
+			return -EINVAL;
 		}
 		buf->used	  = d->send_sizes[i];
 		buf->while_locked = while_locked;