Commit 9649399e authored by Chris Wilson's avatar Chris Wilson Committed by Daniel Vetter

drm: Do not set outparam on error during GEM handle allocation

Good practice dictates that we do not leak stale information to our
callers, and should avoid overwriting an outparam on an error path.
Reported-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1451986951-3703-1-git-send-email-chris@chris-wilson.co.ukReviewed-by: default avatarThierry Reding <treding@nvidia.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent df7d678b
...@@ -331,6 +331,7 @@ drm_gem_handle_create_tail(struct drm_file *file_priv, ...@@ -331,6 +331,7 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
u32 *handlep) u32 *handlep)
{ {
struct drm_device *dev = obj->dev; struct drm_device *dev = obj->dev;
u32 handle;
int ret; int ret;
WARN_ON(!mutex_is_locked(&dev->object_name_lock)); WARN_ON(!mutex_is_locked(&dev->object_name_lock));
...@@ -353,7 +354,7 @@ drm_gem_handle_create_tail(struct drm_file *file_priv, ...@@ -353,7 +354,7 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
if (ret < 0) if (ret < 0)
goto err_unref; goto err_unref;
*handlep = ret; handle = ret;
ret = drm_vma_node_allow(&obj->vma_node, file_priv->filp); ret = drm_vma_node_allow(&obj->vma_node, file_priv->filp);
if (ret) if (ret)
...@@ -365,13 +366,14 @@ drm_gem_handle_create_tail(struct drm_file *file_priv, ...@@ -365,13 +366,14 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
goto err_revoke; goto err_revoke;
} }
*handlep = handle;
return 0; return 0;
err_revoke: err_revoke:
drm_vma_node_revoke(&obj->vma_node, file_priv->filp); drm_vma_node_revoke(&obj->vma_node, file_priv->filp);
err_remove: err_remove:
spin_lock(&file_priv->table_lock); spin_lock(&file_priv->table_lock);
idr_remove(&file_priv->object_idr, *handlep); idr_remove(&file_priv->object_idr, handle);
spin_unlock(&file_priv->table_lock); spin_unlock(&file_priv->table_lock);
err_unref: err_unref:
drm_gem_object_handle_unreference_unlocked(obj); drm_gem_object_handle_unreference_unlocked(obj);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment