Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d59bae5 authored by Chris Wilson's avatar Chris Wilson Committed by Dave Airlie
Browse files

drm: Do not leak a new reference for flink() on an existing name 



The name table should only hold a single reference, so avoid leaking
additional references for secondary calls to flink().

Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Signed-off-by: default avatarDave Airlie <airlied@linux.ie>
parent a35f2e2b

drivers/gpu/drm/drm_gem.c

+16 −17
Original line number Diff line number Diff line
@@ -301,27 +301,25 @@ again: 
	}



	spin_lock(&dev->object_name_lock);

	if (obj->name) {

		args->name = obj->name;

		spin_unlock(&dev->object_name_lock);

		return 0;

	}

	if (!obj->name) {

		ret = idr_get_new_above(&dev->object_name_idr, obj, 1,

					&obj->name);

		args->name = (uint64_t) obj->name;

		spin_unlock(&dev->object_name_lock);



		if (ret == -EAGAIN)

			goto again;



		if (ret != 0)

			goto err;



	/*

	 * Leave the reference from the lookup around as the

	 * name table now holds one

	 */

		/* Allocate a reference for the name table.  */

		drm_gem_object_reference(obj);

	} else {

		args->name = (uint64_t) obj->name;



	return 0;

		spin_unlock(&dev->object_name_lock);

		ret = 0;

	}



err:

	mutex_lock(&dev->struct_mutex);
@@ -452,6 +450,7 @@ drm_gem_object_handle_free(struct kref *kref) 
	spin_lock(&dev->object_name_lock);

	if (obj->name) {

		idr_remove(&dev->object_name_idr, obj->name);

		obj->name = 0;

		spin_unlock(&dev->object_name_lock);

		/*

		 * The object name held a reference to this object, drop