1 files changed, 7 insertions, 10 deletions

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index c55f338e380b..55d6182555c7 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -282,15 +282,6 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle)
 {
         struct drm_gem_object *obj;
 
-        /* This is gross. The idr system doesn't let us try a delete and
-         * return an error code.  It just spews if you fail at deleting.
-         * So, we have to grab a lock around finding the object and then
-         * doing the delete on it and dropping the refcount, or the user
-         * could race us to double-decrement the refcount and cause a
-         * use-after-free later.  Given the frequency of our handle lookups,
-         * we may want to use ida for number allocation and a hash table
-         * for the pointers, anyway.
-         */
         spin_lock(&filp->table_lock);
 
         /* Check if we currently have a reference on the object */
@@ -334,6 +325,12 @@ int drm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
         if (!obj)
                 return -ENOENT;
 
+        /* Don't allow imported objects to be mapped */
+        if (obj->import_attach) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         ret = drm_gem_create_mmap_offset(obj);
         if (ret)
                 goto out;
@@ -537,7 +534,7 @@ EXPORT_SYMBOL(drm_gem_create_mmap_offset);
  * Note that you are not allowed to change gfp-zones during runtime. That is,
  * shmem_read_mapping_page_gfp() must be called with the same gfp_zone(gfp) as
  * set during initialization. If you have special zone constraints, set them
- * after drm_gem_init_object() via mapping_set_gfp_mask(). shmem-core takes care
+ * after drm_gem_object_init() via mapping_set_gfp_mask(). shmem-core takes care
  * to keep pages in the required zone during swap-in.
  */
 struct page **drm_gem_get_pages(struct drm_gem_object *obj)