A couple of error handlings forgot to process the URB completion.
Those are both with WARN_ON() so should be visible, but we must fix
them in anyway.
Fixes: 7350b2a3fbc6 ("drm/udl: Replace BUG_ON() with WARN_ON()")
Signed-off-by: Takashi Iwai <[email protected]>
---
drivers/gpu/drm/udl/udl_main.c | 8 +++++---
drivers/gpu/drm/udl/udl_transfer.c | 5 ++++-
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 3c97f647883f..8bbb4e2861fb 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -265,11 +265,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
struct udl_device *udl = to_udl(dev);
int ret;
- if (WARN_ON(len > udl->urbs.size))
- return -EINVAL;
-
+ if (WARN_ON(len > udl->urbs.size)) {
+ ret = -EINVAL;
+ goto error;
+ }
urb->transfer_buffer_length = len; /* set to actual payload len */
ret = usb_submit_urb(urb, GFP_ATOMIC);
+ error:
if (ret) {
udl_urb_completion(urb); /* because no one else will */
DRM_ERROR("usb_submit_urb error %x\n", ret);
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index a431208dda85..b57844632dbd 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
u8 *cmd = *urb_buf_ptr;
u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;
- if (WARN_ON(!(log_bpp == 1 || log_bpp == 2)))
+ if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) {
+ /* need to finish URB at error from this function */
+ udl_urb_completion(urb);
return -EINVAL;
+ }
line_start = (u8 *) (front + byte_offset);
next_pixel = line_start;
--
2.35.3
Hi
Am 16.08.22 um 17:36 schrieb Takashi Iwai:
> A couple of error handlings forgot to process the URB completion.
> Those are both with WARN_ON() so should be visible, but we must fix
> them in anyway.
>
> Fixes: 7350b2a3fbc6 ("drm/udl: Replace BUG_ON() with WARN_ON()")
> Signed-off-by: Takashi Iwai <[email protected]>
Acked-by: Thomas Zimmermann <[email protected]>
> ---
> drivers/gpu/drm/udl/udl_main.c | 8 +++++---
> drivers/gpu/drm/udl/udl_transfer.c | 5 ++++-
> 2 files changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
> index 3c97f647883f..8bbb4e2861fb 100644
> --- a/drivers/gpu/drm/udl/udl_main.c
> +++ b/drivers/gpu/drm/udl/udl_main.c
> @@ -265,11 +265,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
> struct udl_device *udl = to_udl(dev);
> int ret;
>
> - if (WARN_ON(len > udl->urbs.size))
> - return -EINVAL;
> -
> + if (WARN_ON(len > udl->urbs.size)) {
> + ret = -EINVAL;
> + goto error;
> + }
> urb->transfer_buffer_length = len; /* set to actual payload len */
> ret = usb_submit_urb(urb, GFP_ATOMIC);
> + error:
> if (ret) {
> udl_urb_completion(urb); /* because no one else will */
> DRM_ERROR("usb_submit_urb error %x\n", ret);
> diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
> index a431208dda85..b57844632dbd 100644
> --- a/drivers/gpu/drm/udl/udl_transfer.c
> +++ b/drivers/gpu/drm/udl/udl_transfer.c
> @@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
> u8 *cmd = *urb_buf_ptr;
> u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;
>
> - if (WARN_ON(!(log_bpp == 1 || log_bpp == 2)))
> + if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) {
> + /* need to finish URB at error from this function */
> + udl_urb_completion(urb);
> return -EINVAL;
> + }
>
> line_start = (u8 *) (front + byte_offset);
> next_pixel = line_start;
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev