Attachment #25950 for bug #42024

Lines 352-357 Link Here

(-)linux/drivers/char/drm/gamma_dma.c (-6 / +32 lines)
352	drm_buf_t *buf;	352	drm_buf_t *buf;
353	drm_buf_t *last_buf = NULL;	353	drm_buf_t *last_buf = NULL;
354	drm_device_dma_t *dma = dev->dma;	354	drm_device_dma_t *dma = dev->dma;
		355	int *drm_send_indices = NULL;
		356	int *drm_send_sizes = NULL;
355	DECLARE_WAITQUEUE(entry, current);	357	DECLARE_WAITQUEUE(entry, current);
356		358
357	/* Turn off interrupt handling */	359	/* Turn off interrupt handling */
Lines 371-381 Link Here
371	++must_free;	373	++must_free;
372	}	374	}
373		375
		376	drm_send_indices = kmalloc (d->send_count * sizeof(*drm_send_indices), GFP_KERNEL);
		377	drm_send_sizes = kmalloc (d->send_count * sizeof(*drm_send_sizes), GFP_KERNEL);
		378	if (! drm_send_indices \|\| ! drm_send_sizes)
		379	{
		380	retcode = -ENOMEM;
		381	goto cleanup;
		382	}
		383	if (copy_from_user(drm_send_indices, d->send_indices,
		384	d->send_count * sizeof(*drm_send_indices)) \|\|
		385	copy_from_user(drm_send_sizes, d->send_sizes,
		386	d->send_count * sizeof(*drm_send_sizes)))
		387	{
		388	retcode = -EFAULT;
		389	goto cleanup;
		390	}
		391
374	for (i = 0; i < d->send_count; i++) {	392	for (i = 0; i < d->send_count; i++) {
375	idx = d->send_indices[i];	393	idx = drm_send_indices[i];
376	if (idx < 0 \|\| idx >= dma->buf_count) {	394	if (idx < 0 \|\| idx >= dma->buf_count) {
377	DRM_ERROR("Index %d (of %d max)\n",	395	DRM_ERROR("Index %d (of %d max)\n",
378	d->send_indices[i], dma->buf_count - 1);	396	drm_send_indices[i], dma->buf_count - 1);
379	continue;	397	continue;
380	}	398	}
381	buf = dma->buflist[ idx ];	399	buf = dma->buflist[ idx ];
Lines 397-403 Link Here
397	process closes the /dev/drm? handle, so	415	process closes the /dev/drm? handle, so
398	it can't also be doing DMA. */	416	it can't also be doing DMA. */
399	buf->list = DRM_LIST_PRIO;	417	buf->list = DRM_LIST_PRIO;
400	buf->used = d->send_sizes[i];	418	buf->used = drm_send_sizes[i];
401	buf->context = d->context;	419	buf->context = d->context;
402	buf->while_locked = d->flags & _DRM_DMA_WHILE_LOCKED;	420	buf->while_locked = d->flags & _DRM_DMA_WHILE_LOCKED;
403	address = (unsigned long)buf->address;	421	address = (unsigned long)buf->address;
Lines 408-421 Link Here
408	if (buf->pending) {	426	if (buf->pending) {
409	DRM_ERROR("Sending pending buffer:"	427	DRM_ERROR("Sending pending buffer:"
410	" buffer %d, offset %d\n",	428	" buffer %d, offset %d\n",
411	d->send_indices[i], i);	429	drm_send_indices[i], i);
412	retcode = -EINVAL;	430	retcode = -EINVAL;
413	goto cleanup;	431	goto cleanup;
414	}	432	}
415	if (buf->waiting) {	433	if (buf->waiting) {
416	DRM_ERROR("Sending waiting buffer:"	434	DRM_ERROR("Sending waiting buffer:"
417	" buffer %d, offset %d\n",	435	" buffer %d, offset %d\n",
418	d->send_indices[i], i);	436	drm_send_indices[i], i);
419	retcode = -EINVAL;	437	retcode = -EINVAL;
420	goto cleanup;	438	goto cleanup;
421	}	439	}
Lines 464-469 Link Here
464		482
465		483
466	cleanup:	484	cleanup:
		485	if (drm_send_indices)
		486	kfree(drm_send_indices);
		487	if (drm_send_sizes)
		488	kfree(drm_send_sizes);
467	if (last_buf) {	489	if (last_buf) {
468	gamma_dma_ready(dev);	490	gamma_dma_ready(dev);
469	gamma_free_buffer(dev, last_buf);	491	gamma_free_buffer(dev, last_buf);
Lines 487-493 Link Here
487	drm_device_dma_t *dma = dev->dma;	509	drm_device_dma_t *dma = dev->dma;
488		510
489	if (d->flags & _DRM_DMA_BLOCK) {	511	if (d->flags & _DRM_DMA_BLOCK) {
490	last_buf = dma->buflist[d->send_indices[d->send_count-1]];	512	int lastindex;
		513	if (copy_from_user(&lastindex, &d->send_indices[d->send_count-1],
		514	sizeof(lastindex)))
		515	return -EFAULT;
		516	last_buf = dma->buflist[lastindex];
491	add_wait_queue(&last_buf->dma_wait, &entry);	517	add_wait_queue(&last_buf->dma_wait, &entry);
492	}	518	}
493		519

Lines 392-397 Link Here

(-)linux/drivers/char/drm-4.0/gamma_dma.c (-6 / +32 lines)
392	drm_buf_t *buf;	392	drm_buf_t *buf;
393	drm_buf_t *last_buf = NULL;	393	drm_buf_t *last_buf = NULL;
394	drm_device_dma_t *dma = dev->dma;	394	drm_device_dma_t *dma = dev->dma;
		395	int *drm_send_indices = NULL;
		396	int *drm_send_sizes = NULL;
395	DECLARE_WAITQUEUE(entry, current);	397	DECLARE_WAITQUEUE(entry, current);
396		398
397	/* Turn off interrupt handling */	399	/* Turn off interrupt handling */
Lines 412-422 Link Here
412	}	414	}
413	atomic_inc(&dma->total_prio);	415	atomic_inc(&dma->total_prio);
414		416
		417	drm_send_indices = kmalloc (d->send_count * sizeof(*drm_send_indices), GFP_KERNEL);
		418	drm_send_sizes = kmalloc (d->send_count * sizeof(*drm_send_sizes), GFP_KERNEL);
		419	if (! drm_send_indices \|\| ! drm_send_sizes)
		420	{
		421	retcode = -ENOMEM;
		422	goto cleanup;
		423	}
		424	if (copy_from_user(drm_send_indices, d->send_indices,
		425	d->send_count * sizeof(*drm_send_indices)) \|\|
		426	copy_from_user(drm_send_sizes, d->send_sizes,
		427	d->send_count * sizeof(*drm_send_sizes)))
		428	{
		429	retcode = -EFAULT;
		430	goto cleanup;
		431	}
		432
415	for (i = 0; i < d->send_count; i++) {	433	for (i = 0; i < d->send_count; i++) {
416	idx = d->send_indices[i];	434	idx = drm_send_indices[i];
417	if (idx < 0 \|\| idx >= dma->buf_count) {	435	if (idx < 0 \|\| idx >= dma->buf_count) {
418	DRM_ERROR("Index %d (of %d max)\n",	436	DRM_ERROR("Index %d (of %d max)\n",
419	d->send_indices[i], dma->buf_count - 1);	437	drm_send_indices[i], dma->buf_count - 1);
420	continue;	438	continue;
421	}	439	}
422	buf = dma->buflist[ idx ];	440	buf = dma->buflist[ idx ];
Lines 438-444 Link Here
438	process closes the /dev/drm? handle, so	456	process closes the /dev/drm? handle, so
439	it can't also be doing DMA. */	457	it can't also be doing DMA. */
440	buf->list = DRM_LIST_PRIO;	458	buf->list = DRM_LIST_PRIO;
441	buf->used = d->send_sizes[i];	459	buf->used = drm_send_sizes[i];
442	buf->context = d->context;	460	buf->context = d->context;
443	buf->while_locked = d->flags & _DRM_DMA_WHILE_LOCKED;	461	buf->while_locked = d->flags & _DRM_DMA_WHILE_LOCKED;
444	address = (unsigned long)buf->address;	462	address = (unsigned long)buf->address;
Lines 449-462 Link Here
449	if (buf->pending) {	467	if (buf->pending) {
450	DRM_ERROR("Sending pending buffer:"	468	DRM_ERROR("Sending pending buffer:"
451	" buffer %d, offset %d\n",	469	" buffer %d, offset %d\n",
452	d->send_indices[i], i);	470	drm_send_indices[i], i);
453	retcode = -EINVAL;	471	retcode = -EINVAL;
454	goto cleanup;	472	goto cleanup;
455	}	473	}
456	if (buf->waiting) {	474	if (buf->waiting) {
457	DRM_ERROR("Sending waiting buffer:"	475	DRM_ERROR("Sending waiting buffer:"
458	" buffer %d, offset %d\n",	476	" buffer %d, offset %d\n",
459	d->send_indices[i], i);	477	drm_send_indices[i], i);
460	retcode = -EINVAL;	478	retcode = -EINVAL;
461	goto cleanup;	479	goto cleanup;
462	}	480	}
Lines 505-510 Link Here
505		523
506		524
507	cleanup:	525	cleanup:
		526	if (drm_send_indices)
		527	kfree(drm_send_indices);
		528	if (drm_send_sizes)
		529	kfree(drm_send_sizes);
508	if (last_buf) {	530	if (last_buf) {
509	gamma_dma_ready(dev);	531	gamma_dma_ready(dev);
510	drm_free_buffer(dev, last_buf);	532	drm_free_buffer(dev, last_buf);
Lines 528-534 Link Here
528	drm_device_dma_t *dma = dev->dma;	550	drm_device_dma_t *dma = dev->dma;
529		551
530	if (d->flags & _DRM_DMA_BLOCK) {	552	if (d->flags & _DRM_DMA_BLOCK) {
531	last_buf = dma->buflist[d->send_indices[d->send_count-1]];	553	int lastindex;
		554	if (copy_from_user(&lastindex, &d->send_indices[d->send_count-1],
		555	sizeof(lastindex)))
		556	return -EFAULT;
		557	last_buf = dma->buflist[lastindex];
532	add_wait_queue(&last_buf->dma_wait, &entry);	558	add_wait_queue(&last_buf->dma_wait, &entry);
533	}	559	}
534		560

Return to bug 42024