1 files changed, 57 insertions, 52 deletions

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 2e10bba4468b..2e8c77e71e1f 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -220,6 +220,9 @@ static void drm_gem_object_exported_dma_buf_free(struct drm_gem_object *obj)
 static void
 drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj)
 {
+        struct drm_device *dev = obj->dev;
+        bool final = false;
+
         if (WARN_ON(obj->handle_count == 0))
                 return;
 
@@ -229,14 +232,39 @@ drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj)
         * checked for a name
         */
 
-        mutex_lock(&obj->dev->object_name_lock);
+        mutex_lock(&dev->object_name_lock);
         if (--obj->handle_count == 0) {
                 drm_gem_object_handle_free(obj);
                 drm_gem_object_exported_dma_buf_free(obj);
+                final = true;
         }
-        mutex_unlock(&obj->dev->object_name_lock);
+        mutex_unlock(&dev->object_name_lock);
 
-        drm_gem_object_unreference_unlocked(obj);
+        if (final)
+                drm_gem_object_unreference_unlocked(obj);
+}
+
+/*
+ * Called at device or object close to release the file's
+ * handle references on objects.
+ */
+static int
+drm_gem_object_release_handle(int id, void *ptr, void *data)
+{
+        struct drm_file *file_priv = data;
+        struct drm_gem_object *obj = ptr;
+        struct drm_device *dev = obj->dev;
+
+        if (drm_core_check_feature(dev, DRIVER_PRIME))
+                drm_gem_remove_prime_handles(obj, file_priv);
+        drm_vma_node_revoke(&obj->vma_node, file_priv->filp);
+
+        if (dev->driver->gem_close_object)
+                dev->driver->gem_close_object(obj, file_priv);
+
+        drm_gem_object_handle_unreference_unlocked(obj);
+
+        return 0;
 }
 
 /**
@@ -277,14 +305,7 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle)
         idr_remove(&filp->object_idr, handle);
         spin_unlock(&filp->table_lock);
 
-        if (drm_core_check_feature(dev, DRIVER_PRIME))
-                drm_gem_remove_prime_handles(obj, filp);
-        drm_vma_node_revoke(&obj->vma_node, filp->filp);
-
-        if (dev->driver->gem_close_object)
-                dev->driver->gem_close_object(obj, filp);
-        drm_gem_object_handle_unreference_unlocked(obj);
-
+        drm_gem_object_release_handle(handle, obj, filp);
         return 0;
 }
 EXPORT_SYMBOL(drm_gem_handle_delete);
@@ -326,9 +347,12 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
                            u32 *handlep)
 {
         struct drm_device *dev = obj->dev;
+        u32 handle;
         int ret;
 
         WARN_ON(!mutex_is_locked(&dev->object_name_lock));
+        if (obj->handle_count++ == 0)
+                drm_gem_object_reference(obj);
 
         /*
          * Get the user-visible handle using idr.  Preload and perform
@@ -338,32 +362,38 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
         spin_lock(&file_priv->table_lock);
 
         ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT);
-        drm_gem_object_reference(obj);
-        obj->handle_count++;
+
         spin_unlock(&file_priv->table_lock);
         idr_preload_end();
+
         mutex_unlock(&dev->object_name_lock);
-        if (ret < 0) {
-                drm_gem_object_handle_unreference_unlocked(obj);
-                return ret;
-        }
-        *handlep = ret;
+        if (ret < 0)
+                goto err_unref;
+
+        handle = ret;
 
         ret = drm_vma_node_allow(&obj->vma_node, file_priv->filp);
-        if (ret) {
-                drm_gem_handle_delete(file_priv, *handlep);
-                return ret;
-        }
+        if (ret)
+                goto err_remove;
 
         if (dev->driver->gem_open_object) {
                 ret = dev->driver->gem_open_object(obj, file_priv);
-                if (ret) {
-                        drm_gem_handle_delete(file_priv, *handlep);
-                        return ret;
-                }
+                if (ret)
+                        goto err_revoke;
         }
 
+        *handlep = handle;
         return 0;
+
+err_revoke:
+        drm_vma_node_revoke(&obj->vma_node, file_priv->filp);
+err_remove:
+        spin_lock(&file_priv->table_lock);
+        idr_remove(&file_priv->object_idr, handle);
+        spin_unlock(&file_priv->table_lock);
+err_unref:
+        drm_gem_object_handle_unreference_unlocked(obj);
+        return ret;
 }
 
 /**
@@ -630,7 +660,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
 
         mutex_lock(&dev->object_name_lock);
-        idr_preload(GFP_KERNEL);
         /* prevent races with concurrent gem_close. */
         if (obj->handle_count == 0) {
                 ret = -ENOENT;
@@ -638,7 +667,7 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
         }
 
         if (!obj->name) {
-                ret = idr_alloc(&dev->object_name_idr, obj, 1, 0, GFP_NOWAIT);
+                ret = idr_alloc(&dev->object_name_idr, obj, 1, 0, GFP_KERNEL);
                 if (ret < 0)
                         goto err;
 
@@ -649,7 +678,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
         ret = 0;
 
 err:
-        idr_preload_end();
         mutex_unlock(&dev->object_name_lock);
         drm_gem_object_unreference_unlocked(obj);
         return ret;
@@ -714,29 +742,6 @@ drm_gem_open(struct drm_device *dev, struct drm_file *file_private)
         spin_lock_init(&file_private->table_lock);
 }
 
-/*
- * Called at device close to release the file's
- * handle references on objects.
- */
-static int
-drm_gem_object_release_handle(int id, void *ptr, void *data)
-{
-        struct drm_file *file_priv = data;
-        struct drm_gem_object *obj = ptr;
-        struct drm_device *dev = obj->dev;
-
-        if (drm_core_check_feature(dev, DRIVER_PRIME))
-                drm_gem_remove_prime_handles(obj, file_priv);
-        drm_vma_node_revoke(&obj->vma_node, file_priv->filp);
-
-        if (dev->driver->gem_close_object)
-                dev->driver->gem_close_object(obj, file_priv);
-
-        drm_gem_object_handle_unreference_unlocked(obj);
-
-        return 0;
-}
-
 /**
  * drm_gem_release - release file-private GEM resources
  * @dev: drm_device which is being closed by userspace