summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas Hellstrom <thomas-at-tungstengraphics-dot-com>2007-04-03 10:54:23 +0200
committerThomas Hellstrom <thomas-at-tungstengraphics-dot-com>2007-04-03 10:54:23 +0200
commitc4968279218cf246323e38bbbd44ce2774871fde (patch)
tree84883e5920e90646b5980bc707aa8c8b9b682292
parent38d18acb8f3617d79735f71564d9f49e608461ec (diff)
Fix user object reference when caller is not object creator.
(Reported by Dave Airlie).
-rw-r--r--linux-core/drm_object.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/linux-core/drm_object.c b/linux-core/drm_object.c
index 23412ed0..03906034 100644
--- a/linux-core/drm_object.c
+++ b/linux-core/drm_object.c
@@ -240,11 +240,17 @@ int drm_user_object_ref(drm_file_t * priv, uint32_t user_token,
{
drm_device_t *dev = priv->head->dev;
drm_user_object_t *uo;
+ drm_hash_item_t *hash;
int ret;
mutex_lock(&dev->struct_mutex);
- uo = drm_lookup_user_object(priv, user_token);
- if (!uo || (uo->type != type)) {
+ ret = drm_ht_find_item(&dev->object_hash, user_token, &hash);
+ if (ret) {
+ DRM_ERROR("Could not find user object to reference.\n");
+ goto out_err;
+ }
+ uo = drm_hash_entry(hash, drm_user_object_t, hash);
+ if (uo->type != type) {
ret = -EINVAL;
goto out_err;
}
@@ -253,7 +259,6 @@ int drm_user_object_ref(drm_file_t * priv, uint32_t user_token,
goto out_err;
mutex_unlock(&dev->struct_mutex);
*object = uo;
- DRM_ERROR("Referenced an object\n");
return 0;
out_err:
mutex_unlock(&dev->struct_mutex);
@@ -281,7 +286,6 @@ int drm_user_object_unref(drm_file_t * priv, uint32_t user_token,
}
drm_remove_ref_object(priv, ro);
mutex_unlock(&dev->struct_mutex);
- DRM_ERROR("Unreferenced an object\n");
return 0;
out_err:
mutex_unlock(&dev->struct_mutex);