AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-26 16:20:51 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

drm/radeon: Fix 3 regressions - since buffer rework

Browse Source 
Commit b4fe945405 introduced 3 bugs,
fix them:

* Use the right command dword for second packet offset in
  RADEON_CNTL_PAINT/BITBLT_MULTI.
* Don't leak memory if drm_buffer_copy_from_user() fails.
* Don't call drm_buffer_unprocessed() unless drm_buffer_alloc() and
  drm_buffer_copy_from_user() have been called successfully first.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Pauli Nieminen <suokkos@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Jean Delvare 2010-05-11 14:01:45 +10:00 committed by Dave Airlie
parent 8cfe92d683
commit c9ff04c941
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/gpu/drm/radeon/radeon_state.c
View File

@ -424,7 +424,7 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) && if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
(*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) { (*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3); u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
offset = *cmd << 10; offset = *cmd3 << 10;
if (radeon_check_and_fixup_offset if (radeon_check_and_fixup_offset
(dev_priv, file_priv, &offset)) { (dev_priv, file_priv, &offset)) {
DRM_ERROR("Invalid second packet offset\n"); DRM_ERROR("Invalid second packet offset\n");
@ -2895,9 +2895,12 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
return rv; return rv;
rv = drm_buffer_copy_from_user(cmdbuf->buffer, buffer, rv = drm_buffer_copy_from_user(cmdbuf->buffer, buffer,
cmdbuf->bufsz); cmdbuf->bufsz);
if (rv) if (rv) {
drm_buffer_free(cmdbuf->buffer);
return rv; return rv;
} }
} else
goto done;
orig_nbox = cmdbuf->nbox; orig_nbox = cmdbuf->nbox;
@ -2905,8 +2908,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
int temp; int temp;
temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf); temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf);
if (cmdbuf->bufsz != 0) drm_buffer_free(cmdbuf->buffer);
drm_buffer_free(cmdbuf->buffer);
return temp; return temp;
} }
@ -3012,16 +3014,15 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
} }
} }
if (cmdbuf->bufsz != 0) drm_buffer_free(cmdbuf->buffer);
drm_buffer_free(cmdbuf->buffer);
done:
DRM_DEBUG("DONE\n"); DRM_DEBUG("DONE\n");
COMMIT_RING(); COMMIT_RING();
return 0; return 0;
err: err:
if (cmdbuf->bufsz != 0) drm_buffer_free(cmdbuf->buffer);
drm_buffer_free(cmdbuf->buffer);
return -EINVAL; return -EINVAL;
} }