summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/udl
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2022-09-08 12:51:12 +0300
committerThomas Zimmermann <tzimmermann@suse.de>2022-09-10 22:45:52 +0300
commit046f4f0af7fd1fad06793d863d288c6b2cd84e99 (patch)
tree5fbb0be33a68e5b925d2e738bb0f12f04724017f /drivers/gpu/drm/udl
parentb13fa27a4b72caebe99bd483092479c3767453be (diff)
downloadlinux-046f4f0af7fd1fad06793d863d288c6b2cd84e99.tar.xz
drm/udl: Fix potential URB leaks
A couple of error handlings forgot to process the URB completion. Those are both with WARN_ON() so should be visible, but we must fix them in anyway. Fixes: 7350b2a3fbc6 ("drm/udl: Replace BUG_ON() with WARN_ON()") Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220908095115.23396-10-tiwai@suse.de
Diffstat (limited to 'drivers/gpu/drm/udl')
-rw-r--r--drivers/gpu/drm/udl/udl_main.c8
-rw-r--r--drivers/gpu/drm/udl/udl_transfer.c5
2 files changed, 9 insertions, 4 deletions
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 2b7eafd48ec2..de28eeff3155 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -260,11 +260,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
struct udl_device *udl = to_udl(dev);
int ret;
- if (WARN_ON(len > udl->urbs.size))
- return -EINVAL;
-
+ if (WARN_ON(len > udl->urbs.size)) {
+ ret = -EINVAL;
+ goto error;
+ }
urb->transfer_buffer_length = len; /* set to actual payload len */
ret = usb_submit_urb(urb, GFP_ATOMIC);
+ error:
if (ret) {
udl_urb_completion(urb); /* because no one else will */
DRM_ERROR("usb_submit_urb error %x\n", ret);
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index a431208dda85..b57844632dbd 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
u8 *cmd = *urb_buf_ptr;
u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;
- if (WARN_ON(!(log_bpp == 1 || log_bpp == 2)))
+ if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) {
+ /* need to finish URB at error from this function */
+ udl_urb_completion(urb);
return -EINVAL;
+ }
line_start = (u8 *) (front + byte_offset);
next_pixel = line_start;