drm/prime: add exported buffers to current fprivs imported buffer list (v2)

If userspace attempts to import a buffer it exported on the same device,
we need to return the same GEM handle for it, not a new handle pointing
at the same GEM object.

v2: move removals into a single fn, no need to set to NULL. (Chris Wilson)

Signed-off-by: Dave Airlie <airlied@redhat.com>

2 files changed, 27 insertions, 6 deletions

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 72ba0757feaa..d58e69da1fb5 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -201,6 +201,19 @@ free:
 }
 EXPORT_SYMBOL(drm_gem_object_alloc);
 
+static void
+drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp)
+{
+        if (obj->import_attach) {
+                drm_prime_remove_imported_buf_handle(&filp->prime,
+                                obj->import_attach->dmabuf);
+        }
+        if (obj->export_dma_buf) {
+                drm_prime_remove_imported_buf_handle(&filp->prime,
+                                obj->export_dma_buf);
+        }
+}
+
 /**
  * Removes the mapping from handle to filp for this object.
  */
@@ -233,9 +246,7 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle)
         idr_remove(&filp->object_idr, handle);
         spin_unlock(&filp->table_lock);
 
-        if (obj->import_attach)
-                drm_prime_remove_imported_buf_handle(&filp->prime,
-                                obj->import_attach->dmabuf);
+        drm_gem_remove_prime_handles(obj, filp);
 
         if (dev->driver->gem_close_object)
                 dev->driver->gem_close_object(obj, filp);
@@ -530,9 +541,7 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
         struct drm_gem_object *obj = ptr;
         struct drm_device *dev = obj->dev;
 
-        if (obj->import_attach)
-                drm_prime_remove_imported_buf_handle(&file_priv->prime,
-                                obj->import_attach->dmabuf);
+        drm_gem_remove_prime_handles(obj, file_priv);
 
         if (dev->driver->gem_close_object)
                 dev->driver->gem_close_object(obj, file_priv);
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index 20dbf2c45385..f546ff98a114 100644
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -68,6 +68,7 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev,
 {
         struct drm_gem_object *obj;
         void *buf;
+        int ret;
 
         obj = drm_gem_object_lookup(dev, file_priv, handle);
         if (!obj)
@@ -100,6 +101,17 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev,
                 obj->export_dma_buf = buf;
                 *prime_fd = dma_buf_fd(buf, flags);
         }
+        /* if we've exported this buffer the cheat and add it to the import list
+         * so we get the correct handle back
+         */
+        ret = drm_prime_add_imported_buf_handle(&file_priv->prime,
+                        obj->export_dma_buf, handle);
+        if (ret) {
+                drm_gem_object_unreference_unlocked(obj);
+                mutex_unlock(&file_priv->prime.lock);
+                return ret;
+        }
+
         mutex_unlock(&file_priv->prime.lock);
         return 0;
 }