On Mon, Apr 1, 2019 at 10:43 AM Eric Anholt <e...@anholt.net> wrote: > > Chris Wilson <ch...@chris-wilson.co.uk> writes: > > > Quoting Daniel Vetter (2019-04-01 14:06:48) > >> On Mon, Apr 1, 2019 at 9:47 AM Rob Herring <r...@kernel.org> wrote: > >> > +{ > >> > + int i, ret = 0; > >> > + struct drm_gem_object *obj; > >> > + > >> > + spin_lock(&filp->table_lock); > >> > + > >> > + for (i = 0; i < count; i++) { > >> > + /* Check if we currently have a reference on the object > >> > */ > >> > + obj = idr_find(&filp->object_idr, handle[i]); > >> > + if (!obj) { > >> > + ret = -ENOENT; > > > > Unwind previous drm_gem_object_get(), the caller has no idea how many > > were processed before the error. > > I had the same thought, but the pattern we have is that you're loading > into a refcounted struct that will free the BOs when you're done, > anyway.
The real bug here is if allocation of the array fails. The BO array may be NULL when the count is not. So this V3D cleanup hunk: for (i = 0; i < exec->bo_count; i++) drm_gem_object_put_unlocked(&exec->bo[i]->base.base); kvfree(exec->bo); Needs to be wrapped with 'if (exec->bo)'. We have a similar problem with fence arrays too. Thanks to Steven for noticing this copied code in panfrost. Rob _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel