Commit 046f4f0a authored by Takashi Iwai's avatar Takashi Iwai Committed by Thomas Zimmermann
Browse files

drm/udl: Fix potential URB leaks 



A couple of error handlings forgot to process the URB completion.
Those are both with WARN_ON() so should be visible, but we must fix
them in anyway.

Fixes: 7350b2a3 ("drm/udl: Replace BUG_ON() with WARN_ON()")
Acked-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20220908095115.23396-10-tiwai@suse.de
parent b13fa27a

drivers/gpu/drm/udl/udl_main.c

+5 −3
Original line number Diff line number Diff line
@@ -260,11 +260,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len) 
	struct udl_device *udl = to_udl(dev);

	int ret;



	if (WARN_ON(len > udl->urbs.size))

		return -EINVAL;



	if (WARN_ON(len > udl->urbs.size)) {

		ret = -EINVAL;

		goto error;

	}

	urb->transfer_buffer_length = len; /* set to actual payload len */

	ret = usb_submit_urb(urb, GFP_ATOMIC);

 error:

	if (ret) {

		udl_urb_completion(urb); /* because no one else will */

		DRM_ERROR("usb_submit_urb error %x\n", ret);

drivers/gpu/drm/udl/udl_transfer.c

+4 −1
Original line number Diff line number Diff line
@@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr, 
	u8 *cmd = *urb_buf_ptr;

	u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;



	if (WARN_ON(!(log_bpp == 1 || log_bpp == 2)))

	if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) {

		/* need to finish URB at error from this function */

		udl_urb_completion(urb);

		return -EINVAL;

	}



	line_start = (u8 *) (front + byte_offset);

	next_pixel = line_start;