Attachment 37185 Details for Bug 29153 – Check master exists before dereferencing.

[patch] Check master exists before dereferencing.

0001-drm-i915-ums-Sanity-check-the-existence-of-the-maste.patch (text/plain), 4.35 KB, created by Chris Wilson on 2010-07-19 12:32:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Wilson

Created: 2010-07-19 12:32:22 UTC

Size: 4.35 KB

patch

obsolete

>From 9b37c1420099988afce42d2665d0dc36259e67c1 Mon Sep 17 00:00:00 2001
>From: Chris Wilson <chris@chris-wilson.co.uk>
>Date: Sun, 18 Jul 2010 21:40:44 +0100
>Subject: [PATCH] drm/i915/ums: Sanity check the existence of the master device before use
>
>Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
>---
> drivers/gpu/drm/i915/i915_irq.c |   41 +++++++++++++++++++++++---------------
> 1 files changed, 25 insertions(+), 16 deletions(-)
>
>diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
>index f01aa15..fa6c4f8 100644
>--- a/drivers/gpu/drm/i915/i915_irq.c
>+++ b/drivers/gpu/drm/i915/i915_irq.c
>@@ -308,7 +308,6 @@ static irqreturn_t ironlake_irq_handler(struct drm_device *dev)
> 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
> 	int ret = IRQ_NONE;
> 	u32 de_iir, gt_iir, de_ier, pch_iir;
>-	struct drm_i915_master_private *master_priv;
> 	struct intel_ring_buffer *render_ring = &dev_priv->render_ring;
> 
> 	/* disable master interrupt before clearing iir  */
>@@ -326,6 +325,8 @@ static irqreturn_t ironlake_irq_handler(struct drm_device *dev)
> 	ret = IRQ_HANDLED;
> 
> 	if (dev->primary->master) {
>+		struct drm_i915_master_private *master_priv;
>+
> 		master_priv = dev->primary->master->driver_priv;
> 		if (master_priv->sarea_priv)
> 			master_priv->sarea_priv->last_dispatch =
>@@ -896,7 +897,6 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
> {
> 	struct drm_device *dev = (struct drm_device *) arg;
> 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
>-	struct drm_i915_master_private *master_priv;
> 	u32 iir, new_iir;
> 	u32 pipea_stats, pipeb_stats;
> 	u32 vblank_status;
>@@ -975,6 +975,8 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
> 		new_iir = I915_READ(IIR); /* Flush posted writes */
> 
> 		if (dev->primary->master) {
>+			struct drm_i915_master_private *master_priv;
>+
> 			master_priv = dev->primary->master->driver_priv;
> 			if (master_priv->sarea_priv)
> 				master_priv->sarea_priv->last_dispatch =
>@@ -1049,7 +1051,6 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
> static int i915_emit_irq(struct drm_device * dev)
> {
> 	drm_i915_private_t *dev_priv = dev->dev_private;
>-	struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
> 
> 	i915_kernel_lost_context(dev);
> 
>@@ -1058,8 +1059,14 @@ static int i915_emit_irq(struct drm_device * dev)
> 	dev_priv->counter++;
> 	if (dev_priv->counter > 0x7FFFFFFFUL)
> 		dev_priv->counter = 1;
>-	if (master_priv->sarea_priv)
>-		master_priv->sarea_priv->last_enqueue = dev_priv->counter;
>+
>+	if (dev->primary->master) {
>+		struct drm_i915_master_private *master_priv;
>+
>+		master_priv = dev->primary->master->driver_priv;
>+		if (master_priv->sarea_priv)
>+			master_priv->sarea_priv->last_enqueue = dev_priv->counter;
>+	}
> 
> 	BEGIN_LP_RING(4);
> 	OUT_RING(MI_STORE_DWORD_INDEX);
>@@ -1085,22 +1092,26 @@ void i915_trace_irq_get(struct drm_device *dev, u32 seqno)
> static int i915_wait_irq(struct drm_device * dev, int irq_nr)
> {
> 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
>-	struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
>-	int ret = 0;
> 	struct intel_ring_buffer *render_ring = &dev_priv->render_ring;
>+	int ret = 0;
> 
> 	DRM_DEBUG_DRIVER("irq_nr=%d breadcrumb=%d\n", irq_nr,
> 		  READ_BREADCRUMB(dev_priv));
> 
>-	if (READ_BREADCRUMB(dev_priv) >= irq_nr) {
>+	if (dev->primary->master) {
>+		struct drm_i915_master_private *master_priv;
>+
>+		master_priv = dev->primary->master->driver_priv;
>+		if (READ_BREADCRUMB(dev_priv) >= irq_nr) {
>+			if (master_priv->sarea_priv)
>+				master_priv->sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
>+			return 0;
>+		}
>+
> 		if (master_priv->sarea_priv)
>-			master_priv->sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
>-		return 0;
>+			master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
> 	}
> 
>-	if (master_priv->sarea_priv)
>-		master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
>-
> 	render_ring->user_irq_get(dev, render_ring);
> 	DRM_WAIT_ON(ret, dev_priv->render_ring.irq_queue, 3 * DRM_HZ,
> 		    READ_BREADCRUMB(dev_priv) >= irq_nr);
>@@ -1134,10 +1145,8 @@ int i915_irq_emit(struct drm_device *dev, void *data,
> 	result = i915_emit_irq(dev);
> 	mutex_unlock(&dev->struct_mutex);
> 
>-	if (DRM_COPY_TO_USER(emit->irq_seq, &result, sizeof(int))) {
>-		DRM_ERROR("copy_to_user\n");
>+	if (DRM_COPY_TO_USER(emit->irq_seq, &result, sizeof(int)))
> 		return -EFAULT;
>-	}
> 
> 	return 0;
> }
>-- 
>1.7.1
>

Actions: View | Splinter Review

Attachments on bug 29153: 37184 | 37185 | 37353 | 37415

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.