From 8e758c001c2a4e2a2f6d9cbc14c4492b58941efc Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thellstrom@vmware.com>
Date: Tue, 9 Nov 2010 21:31:44 +0100
Subject: [PATCH] --- yaml --- r: 221799 b: refs/heads/master c:
 7dfbbdcffebc41441e64278961f57d2840a76259 h: refs/heads/master i:   221797:
 c0bca891640a6246234648d8ae98c609e9ce20a0   221795:
 a46306a3fd56b61c470a4a4d1d11891ad889ed88   221791:
 1a9b7a599596f7bc67bf35893a966a6dcd6c2a16 v: v3

---
 [refs]                             | 2 +-
 trunk/drivers/gpu/drm/ttm/ttm_bo.c | 4 ++++
 trunk/include/drm/ttm/ttm_bo_api.h | 4 ++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index d55a2f950dd2..19780d5e2343 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 2b66b50b12cabc05f05543e792d4c9c2465d5702
+refs/heads/master: 7dfbbdcffebc41441e64278961f57d2840a76259
diff --git a/trunk/drivers/gpu/drm/ttm/ttm_bo.c b/trunk/drivers/gpu/drm/ttm/ttm_bo.c
index ce464579c485..3ca77dc03915 100644
--- a/trunk/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/trunk/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1144,6 +1144,10 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
 	num_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 	if (num_pages == 0) {
 		printk(KERN_ERR TTM_PFX "Illegal buffer object size.\n");
+		if (destroy)
+			(*destroy)(bo);
+		else
+			kfree(bo);
 		return -EINVAL;
 	}
 	bo->destroy = destroy;
diff --git a/trunk/include/drm/ttm/ttm_bo_api.h b/trunk/include/drm/ttm/ttm_bo_api.h
index 5afa5b52063e..beafc156a535 100644
--- a/trunk/include/drm/ttm/ttm_bo_api.h
+++ b/trunk/include/drm/ttm/ttm_bo_api.h
@@ -432,6 +432,10 @@ extern void ttm_bo_synccpu_write_release(struct ttm_buffer_object *bo);
  * together with the @destroy function,
  * enables driver-specific objects derived from a ttm_buffer_object.
  * On successful return, the object kref and list_kref are set to 1.
+ * If a failure occurs, the function will call the @destroy function, or
+ * kfree() if @destroy is NULL. Thus, after a failure, dereferencing @bo is
+ * illegal and will likely cause memory corruption.
+ *
  * Returns
  * -ENOMEM: Out of memory.
  * -EINVAL: Invalid placement flags.