public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-04 08:17:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

drm/i915: Kill drop_pages()

Browse source 
The drop_pages() function is a dangerous trap in that it can release the
passed in object pointer and so unless the caller is aware, it can
easily trick us into using the stale object afterwards. Move it into its
solitary callsite where we know it is safe.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1470293567-10811-9-git-send-email-chris@chris-wilson.co.uk
This commit is contained in:
Chris Wilson 2016-08-04 07:52:28 +01:00
parent aa653a685d
commit 4717ca9eec
1 changed files with 5 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
drivers/gpu/drm/i915/i915_gem.c
View file

@ -306,20 +306,6 @@ i915_gem_object_unbind(struct drm_i915_gem_object *obj)
return ret;
}
static int
drop_pages(struct drm_i915_gem_object *obj)
{
int ret;
i915_gem_object_get(obj);
ret = i915_gem_object_unbind(obj);
if (ret == 0)
ret = i915_gem_object_put_pages(obj);
i915_gem_object_put(obj);
return ret;
}
int
i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
int align)
@ -340,7 +326,11 @@ i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
if (obj->base.filp == NULL)
return -EINVAL;
ret = drop_pages(obj);
ret = i915_gem_object_unbind(obj);
if (ret)
return ret;
ret = i915_gem_object_put_pages(obj);
if (ret)
return ret;