From 9a2ae28fbe0e1e5cce0a5d89fbcc84fbdba1206e Mon Sep 17 00:00:00 2001 From: Owain Ainsworth Date: Tue, 27 May 2008 15:07:04 -0700 Subject: [BSD] Fix lock leaks in error paths in drm_bufs.c. --- bsd-core/drm_bufs.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/bsd-core/drm_bufs.c b/bsd-core/drm_bufs.c index 7cefb773..3508331a 100644 --- a/bsd-core/drm_bufs.c +++ b/bsd-core/drm_bufs.c @@ -152,8 +152,10 @@ int drm_addmap(struct drm_device * dev, unsigned long offset, * initialization necessary. */ map = malloc(sizeof(*map), M_DRM, M_ZERO | M_NOWAIT); - if ( !map ) + if ( !map ) { + DRM_LOCK(); return ENOMEM; + } map->offset = offset; map->size = size; @@ -176,6 +178,7 @@ int drm_addmap(struct drm_device * dev, unsigned long offset, map->size, drm_order(map->size), map->handle ); if ( !map->handle ) { free(map, M_DRM); + DRM_LOCK(); return ENOMEM; } map->offset = (unsigned long)map->handle; @@ -216,12 +219,14 @@ int drm_addmap(struct drm_device * dev, unsigned long offset, } if (!valid) { free(map, M_DRM); + DRM_LOCK(); return EACCES; }*/ break; case _DRM_SCATTER_GATHER: if (!dev->sg) { free(map, M_DRM); + DRM_LOCK(); return EINVAL; } map->offset = map->offset + dev->sg->handle; @@ -239,6 +244,7 @@ int drm_addmap(struct drm_device * dev, unsigned long offset, map->dmah = drm_pci_alloc(dev, map->size, align, 0xfffffffful); if (map->dmah == NULL) { free(map, M_DRM); + DRM_LOCK(); return ENOMEM; } map->handle = map->dmah->vaddr; @@ -247,6 +253,7 @@ int drm_addmap(struct drm_device * dev, unsigned long offset, default: DRM_ERROR("Bad map type %d\n", map->type); free(map, M_DRM); + DRM_LOCK(); return EINVAL; } @@ -788,8 +795,6 @@ int drm_addbufs_agp(struct drm_device *dev, drm_buf_desc_t *request) { int order, ret; - DRM_SPINLOCK(&dev->dma_lock); - if (request->count < 0 || request->count > 4096) return EINVAL; @@ -797,6 +802,8 @@ int drm_addbufs_agp(struct drm_device *dev, drm_buf_desc_t *request) if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) return EINVAL; + DRM_SPINLOCK(&dev->dma_lock); + /* No more allocations after first buffer-using ioctl. */ if (dev->buf_use != 0) { DRM_SPINUNLOCK(&dev->dma_lock); @@ -819,14 +826,14 @@ int drm_addbufs_sg(struct drm_device *dev, drm_buf_desc_t *request) { int order, ret; - DRM_SPINLOCK(&dev->dma_lock); - if (!DRM_SUSER(DRM_CURPROC)) return EACCES; if (request->count < 0 || request->count > 4096) return EINVAL; - + + DRM_SPINLOCK(&dev->dma_lock); + order = drm_order(request->size); if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) return EINVAL; @@ -853,18 +860,18 @@ int drm_addbufs_pci(struct drm_device *dev, drm_buf_desc_t *request) { int order, ret; - DRM_SPINLOCK(&dev->dma_lock); - if (!DRM_SUSER(DRM_CURPROC)) return EACCES; if (request->count < 0 || request->count > 4096) return EINVAL; - + order = drm_order(request->size); if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) return EINVAL; + DRM_SPINLOCK(&dev->dma_lock); + /* No more allocations after first buffer-using ioctl. */ if (dev->buf_use != 0) { DRM_SPINUNLOCK(&dev->dma_lock); @@ -967,6 +974,7 @@ int drm_markbufs(struct drm_device *dev, void *data, struct drm_file *file_priv) DRM_SPINLOCK(&dev->dma_lock); if (request->low_mark > dma->bufs[order].buf_count || request->high_mark > dma->bufs[order].buf_count) { + DRM_SPINUNLOCK(&dev->dma_lock); return EINVAL; } -- cgit v1.2.3