Messages in this thread | | | From | Rob Herring <> | Date | Mon, 8 Apr 2019 15:09:06 -0500 | Subject | Re: [PATCH v2 2/3] drm: Add a drm_gem_objects_lookup helper |
| |
On Mon, Apr 1, 2019 at 10:43 AM Eric Anholt <eric@anholt.net> wrote: > > Chris Wilson <chris@chris-wilson.co.uk> writes: > > > Quoting Daniel Vetter (2019-04-01 14:06:48) > >> On Mon, Apr 1, 2019 at 9:47 AM Rob Herring <robh@kernel.org> wrote: > >> > +{ > >> > + int i, ret = 0; > >> > + struct drm_gem_object *obj; > >> > + > >> > + spin_lock(&filp->table_lock); > >> > + > >> > + for (i = 0; i < count; i++) { > >> > + /* Check if we currently have a reference on the object */ > >> > + obj = idr_find(&filp->object_idr, handle[i]); > >> > + if (!obj) { > >> > + ret = -ENOENT; > > > > Unwind previous drm_gem_object_get(), the caller has no idea how many > > were processed before the error. > > I had the same thought, but the pattern we have is that you're loading > into a refcounted struct that will free the BOs when you're done, > anyway.
The real bug here is if allocation of the array fails. The BO array may be NULL when the count is not. So this V3D cleanup hunk:
for (i = 0; i < exec->bo_count; i++) drm_gem_object_put_unlocked(&exec->bo[i]->base.base); kvfree(exec->bo);
Needs to be wrapped with 'if (exec->bo)'. We have a similar problem with fence arrays too.
Thanks to Steven for noticing this copied code in panfrost.
Rob
| |