disable FB

hc

2024-01-04 1543e317f1da31b75942316931e8f491a8920811

 kernel/drivers/gpu/drm/drm_property.c
..
..
@@ -21,13 +21,15 @@
21
21
  */
22
22
 
23
23
 #include <linux/export.h>
24
-#include <drm/drmP.h>
24
+#include <linux/uaccess.h>
25
+
26
+#include <drm/drm_crtc.h>
27
+#include <drm/drm_drv.h>
28
+#include <drm/drm_file.h>
29
+#include <drm/drm_framebuffer.h>
25
30
 #include <drm/drm_property.h>
26
31
 
27
32
 #include "drm_crtc_internal.h"
28
-
29
-#define MAX_BLOB_PROP_SIZE	(PAGE_SIZE * 30)
30
-#define MAX_BLOB_PROP_COUNT	250
31
33
 
32
34
 /**
33
35
  * DOC: overview
..
..
@@ -467,7 +469,7 @@
467
469
 	uint64_t __user *values_ptr;
468
470
 
469
471
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
470
-		return -EINVAL;
472
+		return -EOPNOTSUPP;
471
473
 
472
474
 	property = drm_property_find(dev, file_priv, out_resp->prop_id);
473
475
 	if (!property)
..
..
@@ -559,8 +561,7 @@
559
561
 	struct drm_property_blob *blob;
560
562
 	int ret;
561
563
 
562
-	if (!length || length > MAX_BLOB_PROP_SIZE -
563
-				sizeof(struct drm_property_blob))
564
+	if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
564
565
 		return ERR_PTR(-EINVAL);
565
566
 
566
567
 	blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
..
..
@@ -761,7 +762,7 @@
761
762
 	int ret = 0;
762
763
 
763
764
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
764
-		return -EINVAL;
765
+		return -EOPNOTSUPP;
765
766
 
766
767
 	blob = drm_property_lookup_blob(dev, out_resp->blob_id);
767
768
 	if (!blob)
..
..
@@ -786,19 +787,10 @@
786
787
 			      void *data, struct drm_file *file_priv)
787
788
 {
788
789
 	struct drm_mode_create_blob *out_resp = data;
789
-	struct drm_property_blob *blob, *bt;
790
+	struct drm_property_blob *blob;
790
791
 	int ret = 0;
791
-	u32 count = 0;
792
792
 
793
793
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
794
-		return -EINVAL;
795
-
796
-	mutex_lock(&dev->mode_config.blob_lock);
797
-	list_for_each_entry(bt, &file_priv->blobs, head_file)
798
-		count++;
799
-	mutex_unlock(&dev->mode_config.blob_lock);
800
-
801
-	if (count >= MAX_BLOB_PROP_COUNT)
802
794
 		return -EOPNOTSUPP;
803
795
 
804
796
 	blob = drm_property_create_blob(dev, out_resp->length, NULL);
..
..
@@ -836,7 +828,7 @@
836
828
 	int ret = 0;
837
829
 
838
830
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
839
-		return -EINVAL;
831
+		return -EOPNOTSUPP;
840
832
 
841
833
 	blob = drm_property_lookup_blob(dev, out_resp->blob_id);
842
834
 	if (!blob)
..
..
@@ -879,7 +871,7 @@
879
871
  * value doesn't become invalid part way through the property update due to
880
872
  * race).  The value returned by reference via 'obj' should be passed back
881
873
  * to drm_property_change_valid_put() after the property is set (and the
882
- * object to which the property is attached has a chance to take it's own
874
+ * object to which the property is attached has a chance to take its own
883
875
  * reference).
884
876
  */
885
877
 bool drm_property_change_valid_get(struct drm_property *property,