2018-12-29 12:49:55

by Yue Haibing

Subject: [PATCH -next] drm: Fix error handling in drm_legacy_addctx

'ctx->handle' is unsigned, it never less than zero.
This patch use int 'tmp_handle' to handle the err condition.

Fixes: 62968144e673 ("drm: convert drm context code to use Linux idr")
Signed-off-by: YueHaibing <[email protected]>
---
drivers/gpu/drm/drm_context.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
index 506663c..8e73fab 100644
--- a/drivers/gpu/drm/drm_context.c
+++ b/drivers/gpu/drm/drm_context.c
@@ -361,23 +361,26 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
{
struct drm_ctx_list *ctx_entry;
struct drm_ctx *ctx = data;
+ int tmp_handle;

if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
!drm_core_check_feature(dev, DRIVER_LEGACY))
return -EOPNOTSUPP;

- ctx->handle = drm_legacy_ctxbitmap_next(dev);
- if (ctx->handle == DRM_KERNEL_CONTEXT) {
+ tmp_handle = drm_legacy_ctxbitmap_next(dev);
+ if (tmp_handle == DRM_KERNEL_CONTEXT) {
/* Skip kernel's context and get a new one. */
- ctx->handle = drm_legacy_ctxbitmap_next(dev);
+ tmp_handle = drm_legacy_ctxbitmap_next(dev);
}
- DRM_DEBUG("%d\n", ctx->handle);
- if (ctx->handle < 0) {
+ DRM_DEBUG("%d\n", tmp_handle);
+ if (tmp_handle < 0) {
DRM_DEBUG("Not enough free contexts.\n");
/* Should this return -EBUSY instead? */
- return -ENOMEM;
+ return tmp_handle;
}

+ ctx->handle = tmp_handle;
+
ctx_entry = kmalloc(sizeof(*ctx_entry), GFP_KERNEL);
if (!ctx_entry) {
DRM_DEBUG("out of memory\n");
--
2.7.0

2019-01-07 10:29:56

by Daniel Vetter

Subject: Re: [PATCH -next] drm: Fix error handling in drm_legacy_addctx

On Sat, Dec 29, 2018 at 10:49:07AM +0800, YueHaibing wrote:
> 'ctx->handle' is unsigned, it never less than zero.
> This patch use int 'tmp_handle' to handle the err condition.
>
> Fixes: 62968144e673 ("drm: convert drm context code to use Linux idr")
> Signed-off-by: YueHaibing <[email protected]>

Queue for 5.1 (since this is essentially dead legacy code there's no
really a need to backport this).
-Daniel

> ---
> drivers/gpu/drm/drm_context.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
> index 506663c..8e73fab 100644
> --- a/drivers/gpu/drm/drm_context.c
> +++ b/drivers/gpu/drm/drm_context.c
> @@ -361,23 +361,26 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
> {
> struct drm_ctx_list *ctx_entry;
> struct drm_ctx *ctx = data;
> + int tmp_handle;
>
> if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
> !drm_core_check_feature(dev, DRIVER_LEGACY))
> return -EOPNOTSUPP;
>
> - ctx->handle = drm_legacy_ctxbitmap_next(dev);
> - if (ctx->handle == DRM_KERNEL_CONTEXT) {
> + tmp_handle = drm_legacy_ctxbitmap_next(dev);
> + if (tmp_handle == DRM_KERNEL_CONTEXT) {
> /* Skip kernel's context and get a new one. */
> - ctx->handle = drm_legacy_ctxbitmap_next(dev);
> + tmp_handle = drm_legacy_ctxbitmap_next(dev);
> }
> - DRM_DEBUG("%d\n", ctx->handle);
> - if (ctx->handle < 0) {
> + DRM_DEBUG("%d\n", tmp_handle);
> + if (tmp_handle < 0) {
> DRM_DEBUG("Not enough free contexts.\n");
> /* Should this return -EBUSY instead? */
> - return -ENOMEM;
> + return tmp_handle;
> }
>
> + ctx->handle = tmp_handle;
> +
> ctx_entry = kmalloc(sizeof(*ctx_entry), GFP_KERNEL);
> if (!ctx_entry) {
> DRM_DEBUG("out of memory\n");
> --
> 2.7.0
>
>

--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch