| Message ID | 20220816153655.27526-10-tiwai@suse.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/udl: More fixes | expand |
Hi Am 16.08.22 um 17:36 schrieb Takashi Iwai: > A couple of error handlings forgot to process the URB completion. > Those are both with WARN_ON() so should be visible, but we must fix > them in anyway. > > Fixes: 7350b2a3fbc6 ("drm/udl: Replace BUG_ON() with WARN_ON()") > Signed-off-by: Takashi Iwai <tiwai@suse.de> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> > --- > drivers/gpu/drm/udl/udl_main.c | 8 +++++--- > drivers/gpu/drm/udl/udl_transfer.c | 5 ++++- > 2 files changed, 9 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c > index 3c97f647883f..8bbb4e2861fb 100644 > --- a/drivers/gpu/drm/udl/udl_main.c > +++ b/drivers/gpu/drm/udl/udl_main.c > @@ -265,11 +265,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len) > struct udl_device *udl = to_udl(dev); > int ret; > > - if (WARN_ON(len > udl->urbs.size)) > - return -EINVAL; > - > + if (WARN_ON(len > udl->urbs.size)) { > + ret = -EINVAL; > + goto error; > + } > urb->transfer_buffer_length = len; /* set to actual payload len */ > ret = usb_submit_urb(urb, GFP_ATOMIC); > + error: > if (ret) { > udl_urb_completion(urb); /* because no one else will */ > DRM_ERROR("usb_submit_urb error %x\n", ret); > diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c > index a431208dda85..b57844632dbd 100644 > --- a/drivers/gpu/drm/udl/udl_transfer.c > +++ b/drivers/gpu/drm/udl/udl_transfer.c > @@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr, > u8 *cmd = *urb_buf_ptr; > u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length; > > - if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) > + if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) { > + /* need to finish URB at error from this function */ > + udl_urb_completion(urb); > return -EINVAL; > + } > > line_start = (u8 *) (front + byte_offset); > next_pixel = line_start;
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c index 3c97f647883f..8bbb4e2861fb 100644 --- a/drivers/gpu/drm/udl/udl_main.c +++ b/drivers/gpu/drm/udl/udl_main.c @@ -265,11 +265,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len) struct udl_device *udl = to_udl(dev); int ret; - if (WARN_ON(len > udl->urbs.size)) - return -EINVAL; - + if (WARN_ON(len > udl->urbs.size)) { + ret = -EINVAL; + goto error; + } urb->transfer_buffer_length = len; /* set to actual payload len */ ret = usb_submit_urb(urb, GFP_ATOMIC); + error: if (ret) { udl_urb_completion(urb); /* because no one else will */ DRM_ERROR("usb_submit_urb error %x\n", ret); diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c index a431208dda85..b57844632dbd 100644 --- a/drivers/gpu/drm/udl/udl_transfer.c +++ b/drivers/gpu/drm/udl/udl_transfer.c @@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr, u8 *cmd = *urb_buf_ptr; u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length; - if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) + if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) { + /* need to finish URB at error from this function */ + udl_urb_completion(urb); return -EINVAL; + } line_start = (u8 *) (front + byte_offset); next_pixel = line_start;
A couple of error handlings forgot to process the URB completion. Those are both with WARN_ON() so should be visible, but we must fix them in anyway. Fixes: 7350b2a3fbc6 ("drm/udl: Replace BUG_ON() with WARN_ON()") Signed-off-by: Takashi Iwai <tiwai@suse.de> --- drivers/gpu/drm/udl/udl_main.c | 8 +++++--- drivers/gpu/drm/udl/udl_transfer.c | 5 ++++- 2 files changed, 9 insertions(+), 4 deletions(-)