Commit f2285343 authored by Rob Clark's avatar Rob Clark
Browse files

drm/msm: Defer fd_install in SUBMIT ioctl 



Avoid fd_install() until there are no more potential error paths, to
avoid put_unused_fd() after the fd is made visible to userspace.

Fixes: 68dc6c2d ("drm/msm: Fix submit error-path leaks")
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarRob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/665363/
parent ad70e46e

drivers/gpu/drm/msm/msm_gem_submit.c

+7 −7
Original line number Diff line number Diff line
@@ -770,12 +770,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, 


	if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) {

		sync_file = sync_file_create(submit->user_fence);

		if (!sync_file) {

		if (!sync_file)

			ret = -ENOMEM;

		} else {

			fd_install(out_fence_fd, sync_file->file);

			args->fence_fd = out_fence_fd;

		}

	}



	if (ret)
@@ -813,10 +809,14 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, 
out_unlock:

	mutex_unlock(&queue->lock);

out_post_unlock:

	if (ret && (out_fence_fd >= 0)) {

	if (ret) {

		if (out_fence_fd >= 0)

			put_unused_fd(out_fence_fd);

		if (sync_file)

			fput(sync_file->file);

	} else if (sync_file) {

		fd_install(out_fence_fd, sync_file->file);

		args->fence_fd = out_fence_fd;

	}



	if (!IS_ERR_OR_NULL(submit)) {