Fixed bug in via_dma.c. The code didn't check that the lock was held by the

    caller. Just that it was held.

4 files changed, 14 insertions, 32 deletions

diff --git a/shared-core/via_dma.c b/shared-core/via_dma.c
index c8aad337..ee4a02ab 100644
--- a/shared-core/via_dma.c
+++ b/shared-core/via_dma.c
@@ -248,10 +248,7 @@ int via_flush_ioctl(DRM_IOCTL_ARGS)
 {
 	DRM_DEVICE;
 
-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-		DRM_ERROR("via_flush_ioctl called without lock held\n");
-		return DRM_ERR(EINVAL);
-	}
+	LOCK_TEST_WITH_RETURN( dev, filp );
 
 	return via_quiescent(dev);
 }
@@ -262,16 +259,13 @@ int via_cmdbuffer(DRM_IOCTL_ARGS)
 	drm_via_cmdbuffer_t cmdbuf;
 	int ret;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t *) data,
 				 sizeof(cmdbuf));
 
 	DRM_DEBUG("via cmdbuffer, buf %p size %lu\n", cmdbuf.buf, cmdbuf.size);
 
-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-		DRM_ERROR("via_cmdbuffer called without lock held\n");
-		return DRM_ERR(EINVAL);
-	}
-
 	ret = via_dispatch_cmdbuffer(dev, &cmdbuf);
 	if (ret) {
 		return ret;
@@ -339,17 +333,14 @@ int via_pci_cmdbuffer(DRM_IOCTL_ARGS)
 	drm_via_cmdbuffer_t cmdbuf;
 	int ret;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t *) data,
 				 sizeof(cmdbuf));
 
 	DRM_DEBUG("via_pci_cmdbuffer, buf %p size %lu\n", cmdbuf.buf,
 		  cmdbuf.size);
 
-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-		DRM_ERROR("via_pci_cmdbuffer called without lock held\n");
-		return DRM_ERR(EINVAL);
-	}
-
 	ret = via_dispatch_pci_cmdbuffer(dev, &cmdbuf);
 	if (ret) {
 		return ret;
diff --git a/shared-core/via_drv.h b/shared-core/via_drv.h
index cce54d02..14afaa13 100644
--- a/shared-core/via_drv.h
+++ b/shared-core/via_drv.h
@@ -28,11 +28,11 @@
 
 #define DRIVER_NAME		"via"
 #define DRIVER_DESC		"VIA Unichrome"
-#define DRIVER_DATE		"20041101"
+#define DRIVER_DATE		"20041103"
 
 #define DRIVER_MAJOR		2
 #define DRIVER_MINOR		0
-#define DRIVER_PATCHLEVEL	3
+#define DRIVER_PATCHLEVEL	4
 
 typedef struct drm_via_ring_buffer {
 	drm_map_t map;
diff --git a/shared/via.h b/shared/via.h
index 070be7ae..0746a46d 100644
--- a/shared/via.h
+++ b/shared/via.h
@@ -30,11 +30,11 @@
 
 #define DRIVER_NAME		"via"
 #define DRIVER_DESC		"VIA Unichrome"
-#define DRIVER_DATE		"20041101"
+#define DRIVER_DATE		"20041103"
 
 #define DRIVER_MAJOR		2
 #define DRIVER_MINOR		0
-#define DRIVER_PATCHLEVEL	3
+#define DRIVER_PATCHLEVEL	4
 
 #define DRIVER_IOCTLS							\
         [DRM_IOCTL_NR(DRM_IOCTL_VIA_ALLOCMEM)]  = { via_mem_alloc,  1, 0 }, \
diff --git a/shared/via_dma.c b/shared/via_dma.c
index d986b9df..39613bc5 100644
--- a/shared/via_dma.c
+++ b/shared/via_dma.c
@@ -249,10 +249,7 @@ int via_flush_ioctl(DRM_IOCTL_ARGS)
 {
 	DRM_DEVICE;
 
-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-		DRM_ERROR("via_flush_ioctl called without lock held\n");
-		return DRM_ERR(EINVAL);
-	}
+	LOCK_TEST_WITH_RETURN( dev, filp );
 
 	return via_quiescent(dev);
 }
@@ -263,16 +260,13 @@ int via_cmdbuffer(DRM_IOCTL_ARGS)
 	drm_via_cmdbuffer_t cmdbuf;
 	int ret;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t *) data,
 				 sizeof(cmdbuf));
 
 	DRM_DEBUG("via cmdbuffer, buf %p size %lu\n", cmdbuf.buf, cmdbuf.size);
 
-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-		DRM_ERROR("via_cmdbuffer called without lock held\n");
-		return DRM_ERR(EINVAL);
-	}
-
 	ret = via_dispatch_cmdbuffer(dev, &cmdbuf);
 	if (ret) {
 		return ret;
@@ -340,17 +334,14 @@ int via_pci_cmdbuffer(DRM_IOCTL_ARGS)
 	drm_via_cmdbuffer_t cmdbuf;
 	int ret;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t *) data,
 				 sizeof(cmdbuf));
 
 	DRM_DEBUG("via_pci_cmdbuffer, buf %p size %lu\n", cmdbuf.buf,
 		  cmdbuf.size);
 
-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
-		DRM_ERROR("via_pci_cmdbuffer called without lock held\n");
-		return DRM_ERR(EINVAL);
-	}
-
 	ret = via_dispatch_pci_cmdbuffer(dev, &cmdbuf);
 	if (ret) {
 		return ret;