[PATCH 8/9] drm: Unify handling of blob and object properties

[Ying Liu]

On Mon, Aug 29, 2016 at 4:27 PM, Daniel Vetter <daniel.vetter at ffwll.ch> wrote:
> They work exactly the same now, after the refcounting unification a bit
> ago. The only reason they're distinct is backwards compat with existing
> userspace.
>
> Cc: Daniel Stone <daniels at collabora.com>
> Reviewed-by: Archit Taneja <architt at codeaurora.org>
> Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
> ---
>  drivers/gpu/drm/drm_property.c | 23 +++++------------------
>  1 file changed, 5 insertions(+), 18 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
> index 162cc9032ae5..b5521f705b1c 100644
> --- a/drivers/gpu/drm/drm_property.c
> +++ b/drivers/gpu/drm/drm_property.c
> @@ -911,20 +911,8 @@ bool drm_property_change_valid_get(struct drm_property *property,
>                 for (i = 0; i < property->num_values; i++)
>                         valid_mask |= (1ULL << property->values[i]);
>                 return !(value & ~valid_mask);
> -       } else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB)) {
> -               struct drm_property_blob *blob;
> -
> -               if (value == 0)
> -                       return true;
> -
> -               blob = drm_property_lookup_blob(property->dev, value);

It looks this patch would cause a NULL pointer dereference when we
run kms_atomic test.
Handing property->values[0] over to __drm_mode_object_find() for
blob property seems to be questionable.

Regards,
Liu Ying

> -               if (blob) {
> -                       *ref = &blob->base;
> -                       return true;
> -               } else {
> -                       return false;
> -               }
> -       } else if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
> +       } else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB) ||
> +                  drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
>                 /* a zero value for an object property translates to null: */
>                 if (value == 0)
>                         return true;
> @@ -941,13 +929,12 @@ bool drm_property_change_valid_get(struct drm_property *property,
>  }
>
>  void drm_property_change_valid_put(struct drm_property *property,
> -               struct drm_mode_object *ref)
> +                                  struct drm_mode_object *ref)
>  {
>         if (!ref)
>                 return;
>
> -       if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT)) {
> +       if (drm_property_type_is(property, DRM_MODE_PROP_OBJECT) ||
> +           drm_property_type_is(property, DRM_MODE_PROP_BLOB))
>                 drm_mode_object_unreference(ref);
> -       } else if (drm_property_type_is(property, DRM_MODE_PROP_BLOB))
> -               drm_property_unreference_blob(obj_to_blob(ref));
>  }
> --
> 2.9.3
>
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel