[PATCH 1/3] drm: Cleanup after failing to create master->unique and dev->name

[Chris Wilson]

Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
---
 drivers/gpu/drm/drm_ioctl.c |   73 ++++++++++++++++++++++++++++++++----------
 1 files changed, 55 insertions(+), 18 deletions(-)

diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 9b9ff46..197267b 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -94,17 +94,24 @@ int drm_setunique(struct drm_device *dev, void *data,
        master->unique_len = u->unique_len;
        master->unique_size = u->unique_len + 1;
        master->unique = kmalloc(master->unique_size, GFP_KERNEL);
-       if (!master->unique)
-               return -ENOMEM;
-       if (copy_from_user(master->unique, u->unique, master->unique_len))
-               return -EFAULT;
+       if (!master->unique) {
+               ret = -ENOMEM;
+               goto err;
+       }
+
+       if (copy_from_user(master->unique, u->unique, master->unique_len)) {
+               ret = -EFAULT;
+               goto err;
+       }

        master->unique[master->unique_len] = '\0';

        dev->devname = kmalloc(strlen(dev->driver->pci_driver.name) +
                               strlen(master->unique) + 2, GFP_KERNEL);
-       if (!dev->devname)
-               return -ENOMEM;
+       if (!dev->devname) {
+               ret = -ENOMEM;
+               goto err;
+       }

        sprintf(dev->devname, "%s@%s", dev->driver->pci_driver.name,
                master->unique);
@@ -113,24 +120,39 @@ int drm_setunique(struct drm_device *dev, void *data,
         * busid.
         */
        ret = sscanf(master->unique, "PCI:%d:%d:%d", &bus, &slot, &func);
-       if (ret != 3)
-               return -EINVAL;
+       if (ret != 3) {
+               ret = -EINVAL;
+               goto err;
+       }
+
        domain = bus >> 8;
        bus &= 0xff;

        if ((domain != drm_get_pci_domain(dev)) ||
            (bus != dev->pdev->bus->number) ||
            (slot != PCI_SLOT(dev->pdev->devfn)) ||
-           (func != PCI_FUNC(dev->pdev->devfn)))
-               return -EINVAL;
+           (func != PCI_FUNC(dev->pdev->devfn))) {
+               ret = -EINVAL;
+               goto err;
+       }

        return 0;
+
+err:
+       kfree(dev->devname);
+       dev->devname = NULL;
+
+       kfree(master->unique);
+       master->unique = NULL;
+       master->unique_len = 0;
+       master->unique_size = 0;
+       return ret;
 }

 static int drm_set_busid(struct drm_device *dev, struct drm_file *file_priv)
 {
        struct drm_master *master = file_priv->master;
-       int len;
+       int len, ret;

        if (master->unique != NULL)
                return -EBUSY;
@@ -138,28 +160,41 @@ static int drm_set_busid(struct drm_device *dev, struct 
drm_file *file_priv)
        master->unique_len = 40;
        master->unique_size = master->unique_len;
        master->unique = kmalloc(master->unique_size, GFP_KERNEL);
-       if (master->unique == NULL)
-               return -ENOMEM;
+       if (master->unique == NULL) {
+               ret = -ENOMEM;
+               goto err;
+       }

        len = snprintf(master->unique, master->unique_len, 
"pci:%04x:%02x:%02x.%d",
                       drm_get_pci_domain(dev),
                       dev->pdev->bus->number,
                       PCI_SLOT(dev->pdev->devfn),
                       PCI_FUNC(dev->pdev->devfn));
-       if (len >= master->unique_len)
+       if (len >= master->unique_len) {
                DRM_ERROR("buffer overflow");
-       else
+               ret = -EINVAL;
+               goto err;
+       } else
                master->unique_len = len;

        dev->devname = kmalloc(strlen(dev->driver->pci_driver.name) +
                               master->unique_len + 2, GFP_KERNEL);
-       if (dev->devname == NULL)
-               return -ENOMEM;
+       if (dev->devname == NULL) {
+               ret = -ENOMEM;
+               goto err;
+       }

        sprintf(dev->devname, "%s@%s", dev->driver->pci_driver.name,
                master->unique);

        return 0;
+
+err:
+       kfree(master->unique);
+       master->unique = NULL;
+       master->unique_len = 0;
+       master->unique_size = 0;
+       return ret;
 }

 /**
@@ -323,7 +358,9 @@ int drm_setversion(struct drm_device *dev, void *data, 
struct drm_file *file_pri
                        /*
                         * Version 1.1 includes tying of DRM to specific device
                         */
-                       drm_set_busid(dev, file_priv);
+                       retcode = drm_set_busid(dev, file_priv);
+                       if (retcode)
+                               goto done;
                }
        }

-- 
1.7.1