提交 4d10cc0f 编写于 作者: D Daniel Vetter

drm/i915: delay master/sarea deref for legacy ioctls

... past the check for DRIVER_MODESET. Avoids races with userspace
opening a master and our sarea setup.

Cc: Signed-off-by: Stéphane Marchesin <marcheu@chromium.org>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
上级 fb19e2ac
...@@ -626,9 +626,8 @@ static int i915_batchbuffer(struct drm_device *dev, void *data, ...@@ -626,9 +626,8 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
struct drm_file *file_priv) struct drm_file *file_priv)
{ {
drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv; struct drm_i915_master_private *master_priv;
drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *) drm_i915_sarea_t *sarea_priv;
master_priv->sarea_priv;
drm_i915_batchbuffer_t *batch = data; drm_i915_batchbuffer_t *batch = data;
int ret; int ret;
struct drm_clip_rect *cliprects = NULL; struct drm_clip_rect *cliprects = NULL;
...@@ -636,6 +635,9 @@ static int i915_batchbuffer(struct drm_device *dev, void *data, ...@@ -636,6 +635,9 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
if (drm_core_check_feature(dev, DRIVER_MODESET)) if (drm_core_check_feature(dev, DRIVER_MODESET))
return -ENODEV; return -ENODEV;
master_priv = dev->primary->master->driver_priv;
sarea_priv = (drm_i915_sarea_t *) master_priv->sarea_priv;
if (!dev_priv->dri1.allow_batchbuffer) { if (!dev_priv->dri1.allow_batchbuffer) {
DRM_ERROR("Batchbuffer ioctl disabled\n"); DRM_ERROR("Batchbuffer ioctl disabled\n");
return -EINVAL; return -EINVAL;
...@@ -682,9 +684,8 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data, ...@@ -682,9 +684,8 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
struct drm_file *file_priv) struct drm_file *file_priv)
{ {
drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv; struct drm_i915_master_private *master_priv;
drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *) drm_i915_sarea_t *sarea_priv;
master_priv->sarea_priv;
drm_i915_cmdbuffer_t *cmdbuf = data; drm_i915_cmdbuffer_t *cmdbuf = data;
struct drm_clip_rect *cliprects = NULL; struct drm_clip_rect *cliprects = NULL;
void *batch_data; void *batch_data;
...@@ -696,6 +697,9 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data, ...@@ -696,6 +697,9 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
if (drm_core_check_feature(dev, DRIVER_MODESET)) if (drm_core_check_feature(dev, DRIVER_MODESET))
return -ENODEV; return -ENODEV;
master_priv = dev->primary->master->driver_priv;
sarea_priv = (drm_i915_sarea_t *) master_priv->sarea_priv;
RING_LOCK_TEST_WITH_RETURN(dev, file_priv); RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
if (cmdbuf->num_cliprects < 0) if (cmdbuf->num_cliprects < 0)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册
反馈
建议
客服 返回
顶部