Rob Herring <r...@kernel.org> writes: > On Mon, Apr 1, 2019 at 10:43 AM Eric Anholt <e...@anholt.net> wrote: >> >> Chris Wilson <ch...@chris-wilson.co.uk> writes: >> >> > Quoting Daniel Vetter (2019-04-01 14:06:48) >> >> On Mon, Apr 1, 2019 at 9:47 AM Rob Herring <r...@kernel.org> wrote: >> >> > +{ >> >> > + int i, ret = 0; >> >> > + struct drm_gem_object *obj; >> >> > + >> >> > + spin_lock(&filp->table_lock); >> >> > + >> >> > + for (i = 0; i < count; i++) { >> >> > + /* Check if we currently have a reference on the object >> >> > */ >> >> > + obj = idr_find(&filp->object_idr, handle[i]); >> >> > + if (!obj) { >> >> > + ret = -ENOENT; >> > >> > Unwind previous drm_gem_object_get(), the caller has no idea how many >> > were processed before the error. >> >> I had the same thought, but the pattern we have is that you're loading >> into a refcounted struct that will free the BOs when you're done, >> anyway. > > The real bug here is if allocation of the array fails. The BO array > may be NULL when the count is not. So this V3D cleanup hunk: > > for (i = 0; i < exec->bo_count; i++) > drm_gem_object_put_unlocked(&exec->bo[i]->base.base); > kvfree(exec->bo); > > Needs to be wrapped with 'if (exec->bo)'. We have a similar problem > with fence arrays too.
Yeah, seems legit. Not really going to write new patches when I've got month-old critical patches I can't get acked, though. :/
signature.asc
Description: PGP signature
_______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu