Merge tag 'drm-misc-next-fixes-2018-01-31' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

This contains a fix to restrict what lessee can do with masters and
another one when waiting for timeouts on reservation objects.

* tag 'drm-misc-next-fixes-2018-01-31' of git://anongit.freedesktop.org/drm/drm-misc:
  drm: Check for lessee in DROP_MASTER ioctl
  dma-buf: fix reservation_object_wait_timeout_rcu once more v2

2 files changed, 11 insertions, 3 deletions

diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
index b759a569b7b8..04ebe2204c12 100644
--- a/drivers/dma-buf/reservation.c
+++ b/drivers/dma-buf/reservation.c
@@ -471,13 +471,15 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
                                          unsigned long timeout)
 {
         struct dma_fence *fence;
-        unsigned seq, shared_count, i = 0;
+        unsigned seq, shared_count;
         long ret = timeout ? timeout : 1;
+        int i;
 
 retry:
         shared_count = 0;
         seq = read_seqcount_begin(&obj->seq);
         rcu_read_lock();
+        i = -1;
 
         fence = rcu_dereference(obj->fence_excl);
         if (fence && !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
@@ -493,14 +495,14 @@ retry:
                 fence = NULL;
         }
 
-        if (!fence && wait_all) {
+        if (wait_all) {
                 struct reservation_object_list *fobj =
                                                 rcu_dereference(obj->fence);
 
                 if (fobj)
                         shared_count = fobj->shared_count;
 
-                for (i = 0; i < shared_count; ++i) {
+                for (i = 0; !fence && i < shared_count; ++i) {
                         struct dma_fence *lfence = rcu_dereference(fobj->shared[i]);
 
                         if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index aad468d170a7..d9c0f7573905 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -230,6 +230,12 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
         if (!dev->master)
                 goto out_unlock;
 
+        if (file_priv->master->lessor != NULL) {
+                DRM_DEBUG_LEASE("Attempt to drop lessee %d as master\n", file_priv->master->lessee_id);
+                ret = -EINVAL;
+                goto out_unlock;
+        }
+
         ret = 0;
         drm_drop_master(dev, file_priv);
 out_unlock: