From: Gustavo Padovan <[email protected]>
Previously we were returning garbage here, fix it by setting it to -1
before the first possible point of failure.
Signed-off-by: Gustavo Padovan <[email protected]>
---
drivers/gpu/drm/msm/msm_gem_submit.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 166e84e..c102b55 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -383,10 +383,13 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
struct msm_gpu *gpu = priv->gpu;
struct dma_fence *in_fence = NULL;
struct sync_file *sync_file = NULL;
+ int in_fence_fd = args->fence_fd;
int out_fence_fd = -1;
unsigned i;
int ret;
+ args->fence_fd = -1;
+
if (!gpu)
return -ENXIO;
@@ -427,7 +430,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
goto out;
if (args->flags & MSM_SUBMIT_FENCE_FD_IN) {
- in_fence = sync_file_get_fence(args->fence_fd);
+ in_fence = sync_file_get_fence(in_fence_fd);
if (!in_fence) {
ret = -EINVAL;
--
2.5.5
On Mon, Dec 12, 2016 at 05:41:08PM -0200, Gustavo Padovan wrote:
> From: Gustavo Padovan <[email protected]>
>
> Previously we were returning garbage here, fix it by setting it to -1
> before the first possible point of failure.
The convention is that on error paths you do not modify user inputs. In
particular, consider EINTR where the usual pattern (e.g. drmIoctl) is
do {
err = ioctl(fd, SUBMIT, arg);
} while (err == -EINTR);
If you modify the in fence before you consume it, you can't recreate it
after handling the signal.
-Chris
--
Chris Wilson, Intel Open Source Technology Centre
2016-12-12 Chris Wilson <[email protected]>:
> On Mon, Dec 12, 2016 at 05:41:08PM -0200, Gustavo Padovan wrote:
> > From: Gustavo Padovan <[email protected]>
> >
> > Previously we were returning garbage here, fix it by setting it to -1
> > before the first possible point of failure.
>
> The convention is that on error paths you do not modify user inputs. In
> particular, consider EINTR where the usual pattern (e.g. drmIoctl) is
>
> do {
> err = ioctl(fd, SUBMIT, arg);
> } while (err == -EINTR);
>
> If you modify the in fence before you consume it, you can't recreate it
> after handling the signal.
Right. I didn't know about that convention. So maybe we let it as is. :)
Gustavo