From patchwork Mon Oct 19 10:27:18 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 7438161 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 40AADBEEA4 for ; Mon, 19 Oct 2015 15:37:47 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 61B132078D for ; Mon, 19 Oct 2015 15:37:46 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 8B7322075F for ; Mon, 19 Oct 2015 15:37:45 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 6F2E26EA58; Mon, 19 Oct 2015 08:37:40 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org X-Greylist: delayed 1206 seconds by postgrey-1.34 at gabe; Mon, 19 Oct 2015 03:47:29 PDT Received: from prv-mh.provo.novell.com (prv-mh.provo.novell.com [137.65.248.74]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2DC7C6E18D for ; Mon, 19 Oct 2015 03:47:29 -0700 (PDT) Received: from INET-PRV-MTA by prv-mh.provo.novell.com with Novell_GroupWise; Mon, 19 Oct 2015 04:27:22 -0600 Message-Id: <5624E1A602000078000AC488@prv-mh.provo.novell.com> X-Mailer: Novell GroupWise Internet Agent 14.0.1 Date: Mon, 19 Oct 2015 04:27:18 -0600 From: "Jan Beulich" To: Subject: [PATCH] drm/mgag200: don't pass NULL file_priv to drm_gem_object_lookup() Mime-Version: 1.0 Content-Disposition: inline X-Mailman-Approved-At: Mon, 19 Oct 2015 08:37:36 -0700 Cc: daniel.vetter@intel.com, treding@nvidia.com, dri-devel@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit bf89209a6d ("drm/mga200g: Hold a proper reference for cursor_set") clearly didn't take the call site in drm_fb_helper.c:restore_fbdev_mode() into account, which passes NULL for file_priv and hence causes drm_gem_object_lookup() to fault. Move the lookup back to before "obj" is actually needed, adjusting error paths suitably once again. Signed-off-by: Jan Beulich Cc: Daniel Vetter Cc: Thierry Reding Reviewed-by: Daniel Vetter --- drivers/gpu/drm/mgag200/mgag200_cursor.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) --- 4.3-rc6/drivers/gpu/drm/mgag200/mgag200_cursor.c +++ 4.3-rc6-mgag200-cursor-set/drivers/gpu/drm/mgag200/mgag200_cursor.c @@ -40,7 +40,7 @@ int mga_crtc_cursor_set(struct drm_crtc struct mgag200_bo *pixels_2 = mdev->cursor.pixels_2; struct mgag200_bo *pixels_current = mdev->cursor.pixels_current; struct mgag200_bo *pixels_prev = mdev->cursor.pixels_prev; - struct drm_gem_object *obj; + struct drm_gem_object *obj = NULL; struct mgag200_bo *bo = NULL; int ret = 0; unsigned int i, row, col; @@ -70,15 +70,11 @@ int mga_crtc_cursor_set(struct drm_crtc BUG_ON(pixels_2 != pixels_current && pixels_2 != pixels_prev); BUG_ON(pixels_current == pixels_prev); - obj = drm_gem_object_lookup(dev, file_priv, handle); - if (!obj) - return -ENOENT; - ret = mgag200_bo_reserve(pixels_1, true); if (ret) { WREG8(MGA_CURPOSXL, 0); WREG8(MGA_CURPOSXH, 0); - goto out_unref; + return ret; } ret = mgag200_bo_reserve(pixels_2, true); if (ret) { @@ -110,6 +106,12 @@ int mga_crtc_cursor_set(struct drm_crtc } } + obj = drm_gem_object_lookup(dev, file_priv, handle); + if (!obj) { + ret = -ENOENT; + goto out1; + } + bo = gem_to_mga_bo(obj); ret = mgag200_bo_reserve(bo, true); if (ret) { @@ -243,13 +245,13 @@ int mga_crtc_cursor_set(struct drm_crtc out2: mgag200_bo_unreserve(bo); out1: + if (obj) + drm_gem_object_unreference_unlocked(obj); if (ret) mga_hide_cursor(mdev); mgag200_bo_unreserve(pixels_1); out_unreserve1: mgag200_bo_unreserve(pixels_2); -out_unref: - drm_gem_object_unreference_unlocked(obj); return ret; }