mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
drm: Fix fb leaks and WARN spew in get/set_prop ioctls
Dave Airlie had at least the refcount leak fixed in a later patch (but
that patch does other things which need a bit more work). But we still
have the trouble that silly userspace could hit the WARN_ON in
drm_mode_object_find.
Fix this all up to make sure we don't leak objects, and don't spew
into demsg.
Fixes: d0f37cf629
("drm/mode: move framebuffer reference into object.")
Testcase: igt/kms_addfb_basic/invalid-*-prop*
Cc: Dave Airlie <airlied@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
parent
05981422ea
commit
1649c33ba3
1 changed files with 9 additions and 7 deletions
|
@ -389,9 +389,7 @@ struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
|
||||||
{
|
{
|
||||||
struct drm_mode_object *obj = NULL;
|
struct drm_mode_object *obj = NULL;
|
||||||
|
|
||||||
/* Framebuffers are reference counted and need their own lookup
|
WARN_ON(type == DRM_MODE_OBJECT_BLOB);
|
||||||
* function.*/
|
|
||||||
WARN_ON(type == DRM_MODE_OBJECT_FB || type == DRM_MODE_OBJECT_BLOB);
|
|
||||||
obj = _object_find(dev, id, type);
|
obj = _object_find(dev, id, type);
|
||||||
return obj;
|
return obj;
|
||||||
}
|
}
|
||||||
|
@ -5005,7 +5003,7 @@ int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
|
||||||
}
|
}
|
||||||
if (!obj->properties) {
|
if (!obj->properties) {
|
||||||
ret = -EINVAL;
|
ret = -EINVAL;
|
||||||
goto out;
|
goto out_unref;
|
||||||
}
|
}
|
||||||
|
|
||||||
ret = get_properties(obj, file_priv->atomic,
|
ret = get_properties(obj, file_priv->atomic,
|
||||||
|
@ -5013,6 +5011,8 @@ int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
|
||||||
(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
|
(uint64_t __user *)(unsigned long)(arg->prop_values_ptr),
|
||||||
&arg->count_props);
|
&arg->count_props);
|
||||||
|
|
||||||
|
out_unref:
|
||||||
|
drm_mode_object_unreference(obj);
|
||||||
out:
|
out:
|
||||||
drm_modeset_unlock_all(dev);
|
drm_modeset_unlock_all(dev);
|
||||||
return ret;
|
return ret;
|
||||||
|
@ -5055,20 +5055,20 @@ int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
if (!arg_obj->properties)
|
if (!arg_obj->properties)
|
||||||
goto out;
|
goto out_unref;
|
||||||
|
|
||||||
for (i = 0; i < arg_obj->properties->count; i++)
|
for (i = 0; i < arg_obj->properties->count; i++)
|
||||||
if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
|
if (arg_obj->properties->properties[i]->base.id == arg->prop_id)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
if (i == arg_obj->properties->count)
|
if (i == arg_obj->properties->count)
|
||||||
goto out;
|
goto out_unref;
|
||||||
|
|
||||||
prop_obj = drm_mode_object_find(dev, arg->prop_id,
|
prop_obj = drm_mode_object_find(dev, arg->prop_id,
|
||||||
DRM_MODE_OBJECT_PROPERTY);
|
DRM_MODE_OBJECT_PROPERTY);
|
||||||
if (!prop_obj) {
|
if (!prop_obj) {
|
||||||
ret = -ENOENT;
|
ret = -ENOENT;
|
||||||
goto out;
|
goto out_unref;
|
||||||
}
|
}
|
||||||
property = obj_to_property(prop_obj);
|
property = obj_to_property(prop_obj);
|
||||||
|
|
||||||
|
@ -5091,6 +5091,8 @@ int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
|
||||||
|
|
||||||
drm_property_change_valid_put(property, ref);
|
drm_property_change_valid_put(property, ref);
|
||||||
|
|
||||||
|
out_unref:
|
||||||
|
drm_mode_object_unreference(arg_obj);
|
||||||
out:
|
out:
|
||||||
drm_modeset_unlock_all(dev);
|
drm_modeset_unlock_all(dev);
|
||||||
return ret;
|
return ret;
|
||||||
|
|
Loading…
Reference in a new issue