Commit bf89209a authored by Daniel Vetter's avatar Daniel Vetter

drm/mga200g: Hold a proper reference for cursor_set

Looking up an obj, immediate dropping the acquired reference and then
continuing to use it isn't how this is supposed to work. Fix this by
holding a reference for the entire function.

While at it stop grabbing dev->struct_mutex, it doesn't protect
anything here.
Reviewed-by: default avatarThierry Reding <treding@nvidia.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
parent 34c294f5
...@@ -70,18 +70,22 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc, ...@@ -70,18 +70,22 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc,
BUG_ON(pixels_2 != pixels_current && pixels_2 != pixels_prev); BUG_ON(pixels_2 != pixels_current && pixels_2 != pixels_prev);
BUG_ON(pixels_current == pixels_prev); BUG_ON(pixels_current == pixels_prev);
obj = drm_gem_object_lookup(dev, file_priv, handle);
if (!obj)
return -ENOENT;
ret = mgag200_bo_reserve(pixels_1, true); ret = mgag200_bo_reserve(pixels_1, true);
if (ret) { if (ret) {
WREG8(MGA_CURPOSXL, 0); WREG8(MGA_CURPOSXL, 0);
WREG8(MGA_CURPOSXH, 0); WREG8(MGA_CURPOSXH, 0);
return ret; goto out_unref;
} }
ret = mgag200_bo_reserve(pixels_2, true); ret = mgag200_bo_reserve(pixels_2, true);
if (ret) { if (ret) {
WREG8(MGA_CURPOSXL, 0); WREG8(MGA_CURPOSXL, 0);
WREG8(MGA_CURPOSXH, 0); WREG8(MGA_CURPOSXH, 0);
mgag200_bo_unreserve(pixels_1); mgag200_bo_unreserve(pixels_1);
return ret; goto out_unreserve1;
} }
if (!handle) { if (!handle) {
...@@ -106,16 +110,6 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc, ...@@ -106,16 +110,6 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc,
} }
} }
mutex_lock(&dev->struct_mutex);
obj = drm_gem_object_lookup(dev, file_priv, handle);
if (!obj) {
mutex_unlock(&dev->struct_mutex);
ret = -ENOENT;
goto out1;
}
drm_gem_object_unreference(obj);
mutex_unlock(&dev->struct_mutex);
bo = gem_to_mga_bo(obj); bo = gem_to_mga_bo(obj);
ret = mgag200_bo_reserve(bo, true); ret = mgag200_bo_reserve(bo, true);
if (ret) { if (ret) {
...@@ -252,7 +246,11 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc, ...@@ -252,7 +246,11 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc,
if (ret) if (ret)
mga_hide_cursor(mdev); mga_hide_cursor(mdev);
mgag200_bo_unreserve(pixels_1); mgag200_bo_unreserve(pixels_1);
out_unreserve1:
mgag200_bo_unreserve(pixels_2); mgag200_bo_unreserve(pixels_2);
out_unref:
drm_gem_object_unreference_unlocked(obj);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment