On Wed, Sep 7, 2016 at 5:52 PM, Maarten Lankhorst
<maarten.lankhorst@xxxxxxxxxxxxxxx> wrote:
> This reverts commit 77953bd136d2a70bca2dc93b3ccda07a2b37076f.
>
> This causes a kernel panic when trying to assign a blob to a property,
> and has obviously never been tested.
>
> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx>
Tested-by: Liu Ying <gnuiyl@xxxxxxxxx>
> ---
> drivers/gpu/drm/drm_property.c | 23 ++++++++++++++++++-----
> 1 file changed, 18 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
> index 4139afbcc267..a4d81cf4ffa0 100644
> --- a/drivers/gpu/drm/drm_property.c
> +++ b/drivers/gpu/drm/drm_property.c
> @@ -870,8 +870,20 @@ bool drm_property_change_valid_get(struct drm_property *property,
> for (i = 0; i < property->num_values; i++)
> valid_mask |= (1ULL << property->values[i]);
> return !(value & ~valid_mask);
> - } else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB) ||
> - drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
> + } else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
> + struct drm_property_blob *blob;
> +
> + if (value == 0)
> + return true;
> +
> + blob = drm_property_lookup_blob(property->dev, value);
> + if (blob) {
> + *ref = &blob->base;
> + return true;
> + } else {
> + return false;
> + }
> + } else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
> /* a zero value for an object property translates to null: */
> if (value == 0)
> return true;
> @@ -888,12 +900,13 @@ bool drm_property_change_valid_get(struct drm_property *property,
> }
>
> void drm_property_change_valid_put(struct drm_property *property,
> - struct drm_mode_object *ref)
> + struct drm_mode_object *ref)
> {
> if (!ref)
> return;
>
> - if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT) ||
> - drm_property_type_is(property, DRM_MODE_PROP_BLOB))
> + if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
> drm_mode_object_unreference(ref);
> + } else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
> + drm_property_unreference_blob(obj_to_blob(ref));
> }
> --
> 2.7.4
>
>
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
