drm/i915: delay master/sarea deref for legacy ioctls
... past the check for DRIVER_MODESET. Avoids races with userspace opening a master and our sarea setup. Cc: Signed-off-by: Stéphane Marchesin <marcheu@chromium.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
This commit is contained in:
parent
fb19e2ac7c
commit
4d10cc0f86
|
@ -626,9 +626,8 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
|
||||||
struct drm_file *file_priv)
|
struct drm_file *file_priv)
|
||||||
{
|
{
|
||||||
drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
|
drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
|
||||||
struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
|
struct drm_i915_master_private *master_priv;
|
||||||
drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *)
|
drm_i915_sarea_t *sarea_priv;
|
||||||
master_priv->sarea_priv;
|
|
||||||
drm_i915_batchbuffer_t *batch = data;
|
drm_i915_batchbuffer_t *batch = data;
|
||||||
int ret;
|
int ret;
|
||||||
struct drm_clip_rect *cliprects = NULL;
|
struct drm_clip_rect *cliprects = NULL;
|
||||||
|
@ -636,6 +635,9 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
|
||||||
if (drm_core_check_feature(dev, DRIVER_MODESET))
|
if (drm_core_check_feature(dev, DRIVER_MODESET))
|
||||||
return -ENODEV;
|
return -ENODEV;
|
||||||
|
|
||||||
|
master_priv = dev->primary->master->driver_priv;
|
||||||
|
sarea_priv = (drm_i915_sarea_t *) master_priv->sarea_priv;
|
||||||
|
|
||||||
if (!dev_priv->dri1.allow_batchbuffer) {
|
if (!dev_priv->dri1.allow_batchbuffer) {
|
||||||
DRM_ERROR("Batchbuffer ioctl disabled\n");
|
DRM_ERROR("Batchbuffer ioctl disabled\n");
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
@ -682,9 +684,8 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
|
||||||
struct drm_file *file_priv)
|
struct drm_file *file_priv)
|
||||||
{
|
{
|
||||||
drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
|
drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
|
||||||
struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
|
struct drm_i915_master_private *master_priv;
|
||||||
drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *)
|
drm_i915_sarea_t *sarea_priv;
|
||||||
master_priv->sarea_priv;
|
|
||||||
drm_i915_cmdbuffer_t *cmdbuf = data;
|
drm_i915_cmdbuffer_t *cmdbuf = data;
|
||||||
struct drm_clip_rect *cliprects = NULL;
|
struct drm_clip_rect *cliprects = NULL;
|
||||||
void *batch_data;
|
void *batch_data;
|
||||||
|
@ -696,6 +697,9 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
|
||||||
if (drm_core_check_feature(dev, DRIVER_MODESET))
|
if (drm_core_check_feature(dev, DRIVER_MODESET))
|
||||||
return -ENODEV;
|
return -ENODEV;
|
||||||
|
|
||||||
|
master_priv = dev->primary->master->driver_priv;
|
||||||
|
sarea_priv = (drm_i915_sarea_t *) master_priv->sarea_priv;
|
||||||
|
|
||||||
RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
|
RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
|
||||||
|
|
||||||
if (cmdbuf->num_cliprects < 0)
|
if (cmdbuf->num_cliprects < 0)
|
||||||
|
|
Loading…
Reference in a new issue