提交 8d59bae5 编写于 作者: C Chris Wilson 提交者: Dave Airlie

drm: Do not leak a new reference for flink() on an existing name

The name table should only hold a single reference, so avoid leaking
additional references for secondary calls to flink().
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@linux.ie>
上级 a35f2e2b
......@@ -301,27 +301,25 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
}
spin_lock(&dev->object_name_lock);
if (obj->name) {
args->name = obj->name;
if (!obj->name) {
ret = idr_get_new_above(&dev->object_name_idr, obj, 1,
&obj->name);
args->name = (uint64_t) obj->name;
spin_unlock(&dev->object_name_lock);
return 0;
}
ret = idr_get_new_above(&dev->object_name_idr, obj, 1,
&obj->name);
spin_unlock(&dev->object_name_lock);
if (ret == -EAGAIN)
goto again;
if (ret != 0)
goto err;
if (ret == -EAGAIN)
goto again;
/*
* Leave the reference from the lookup around as the
* name table now holds one
*/
args->name = (uint64_t) obj->name;
if (ret != 0)
goto err;
return 0;
/* Allocate a reference for the name table. */
drm_gem_object_reference(obj);
} else {
args->name = (uint64_t) obj->name;
spin_unlock(&dev->object_name_lock);
ret = 0;
}
err:
mutex_lock(&dev->struct_mutex);
......@@ -452,6 +450,7 @@ drm_gem_object_handle_free(struct kref *kref)
spin_lock(&dev->object_name_lock);
if (obj->name) {
idr_remove(&dev->object_name_idr, obj->name);
obj->name = 0;
spin_unlock(&dev->object_name_lock);
/*
* The object name held a reference to this object, drop
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册