Rev 4280 | Rev 4560 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
| Rev 4280 | Rev 4539 | ||
|---|---|---|---|
| Line 252... | Line 252... | ||
| 252 | * could race us to double-decrement the refcount and cause a |
252 | * could race us to double-decrement the refcount and cause a |
| 253 | * use-after-free later. Given the frequency of our handle lookups, |
253 | * use-after-free later. Given the frequency of our handle lookups, |
| 254 | * we may want to use ida for number allocation and a hash table |
254 | * we may want to use ida for number allocation and a hash table |
| 255 | * for the pointers, anyway. |
255 | * for the pointers, anyway. |
| 256 | */ |
256 | */ |
| 257 | if(handle == -2) |
- | |
| 258 | printf("%s handle %d\n", __FUNCTION__, handle); |
- | |
| 259 | - | ||
| 260 | spin_lock(&filp->table_lock); |
257 | spin_lock(&filp->table_lock); |
| Line 261... | Line 258... | ||
| 261 | 258 | ||
| 262 | /* Check if we currently have a reference on the object */ |
259 | /* Check if we currently have a reference on the object */ |
| 263 | obj = idr_find(&filp->object_idr, handle); |
260 | obj = idr_find(&filp->object_idr, handle); |
| 264 | if (obj == NULL) { |
261 | if (obj == NULL) { |
| 265 | spin_unlock(&filp->table_lock); |
262 | spin_unlock(&filp->table_lock); |
| 266 | return -EINVAL; |
263 | return -EINVAL; |
| 267 | } |
264 | } |
| Line 268... | Line -... | ||
| 268 | dev = obj->dev; |
- | |
| 269 | - | ||
| 270 | // printf("%s handle %d obj %p\n", __FUNCTION__, handle, obj); |
265 | dev = obj->dev; |
| 271 | 266 | ||
| 272 | /* Release reference and decrement refcount. */ |
267 | /* Release reference and decrement refcount. */ |
| Line 284... | Line 279... | ||
| 284 | 279 | ||
| 285 | /** |
280 | /** |
| 286 | * Create a handle for this object. This adds a handle reference |
281 | * Create a handle for this object. This adds a handle reference |
| 287 | * to the object, which includes a regular reference count. Callers |
282 | * to the object, which includes a regular reference count. Callers |
| - | 283 | * will likely want to dereference the object afterwards. |
|
| - | 284 | /** |
|
| - | 285 | * drm_gem_handle_create_tail - internal functions to create a handle |
|
| - | 286 | * |
|
| - | 287 | * This expects the dev->object_name_lock to be held already and will drop it |
|
| - | 288 | * before returning. Used to avoid races in establishing new handles when |
|
| 288 | * will likely want to dereference the object afterwards. |
289 | * importing an object from either an flink name or a dma-buf. |
| 289 | */ |
290 | */ |
| 290 | int |
291 | int |
| 291 | drm_gem_handle_create_tail(struct drm_file *file_priv, |
292 | drm_gem_handle_create_tail(struct drm_file *file_priv, |
| 292 | struct drm_gem_object *obj, |
293 | struct drm_gem_object *obj, |
| Line 434... | Line 435... | ||
| 434 | drm_gem_object_lookup(struct drm_device *dev, struct drm_file *filp, |
435 | drm_gem_object_lookup(struct drm_device *dev, struct drm_file *filp, |
| 435 | u32 handle) |
436 | u32 handle) |
| 436 | { |
437 | { |
| 437 | struct drm_gem_object *obj; |
438 | struct drm_gem_object *obj; |
| Line 438... | Line -... | ||
| 438 | - | ||
| 439 | if(handle == -2) |
- | |
| 440 | printf("%s handle %d\n", __FUNCTION__, handle); |
- | |
| 441 | 439 | ||
| Line 442... | Line 440... | ||
| 442 | spin_lock(&filp->table_lock); |
440 | spin_lock(&filp->table_lock); |
| 443 | 441 | ||
| 444 | /* Check if we currently have a reference on the object */ |
442 | /* Check if we currently have a reference on the object */ |
| Line 537... | Line 535... | ||
| 537 | u32 handle; |
535 | u32 handle; |
| Line 538... | Line 536... | ||
| 538 | 536 | ||
| 539 | if (!(dev->driver->driver_features & DRIVER_GEM)) |
537 | if (!(dev->driver->driver_features & DRIVER_GEM)) |
| Line 540... | Line -... | ||
| 540 | return -ENODEV; |
- | |
| 541 | - | ||
| 542 | if(handle == -2) |
- | |
| 543 | printf("%s handle %d\n", __FUNCTION__, handle); |
538 | return -ENODEV; |
| 544 | 539 | ||
| 545 | mutex_lock(&dev->object_name_lock); |
540 | mutex_lock(&dev->object_name_lock); |
| 546 | obj = idr_find(&dev->object_name_idr, (int) args->name); |
541 | obj = idr_find(&dev->object_name_idr, (int) args->name); |
| 547 | if (obj) { |
542 | if (obj) { |