diff options
author | Imre Deak <imre.deak@intel.com> | 2013-04-18 21:11:56 -0400 |
---|---|---|
committer | Dave Airlie <airlied@redhat.com> | 2013-04-30 19:40:21 -0400 |
commit | 011c2282c74db120f01a8414edc66c3f217f5511 (patch) | |
tree | 5e43eb6b5d21e8aa29e88f0398fcdd7ca55abdb5 /drivers/gpu/drm/drm_prime.c | |
parent | 219b47339ced80ca580bb6ce7d1636166984afa7 (diff) |
drm: prime: fix refcounting on the dmabuf import error path
In commit be8a42ae60 we inroduced a refcount problem, where on the
drm_gem_prime_fd_to_handle() error path we'll call dma_buf_put() for
self imported dma buffers.
Fix this by taking a reference on the dma buffer in the .gem_import
hook instead of assuming the caller had taken one. Besides fixing the
bug this is also more logical.
Signed-off-by: Imre Deak <imre.deak@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/drm_prime.c')
-rw-r--r-- | drivers/gpu/drm/drm_prime.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 7830d8e1f212..71c7315ca00f 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c | |||
@@ -271,7 +271,6 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, | |||
271 | * refcount on gem itself instead of f_count of dmabuf. | 271 | * refcount on gem itself instead of f_count of dmabuf. |
272 | */ | 272 | */ |
273 | drm_gem_object_reference(obj); | 273 | drm_gem_object_reference(obj); |
274 | dma_buf_put(dma_buf); | ||
275 | return obj; | 274 | return obj; |
276 | } | 275 | } |
277 | } | 276 | } |
@@ -280,6 +279,8 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, | |||
280 | if (IS_ERR(attach)) | 279 | if (IS_ERR(attach)) |
281 | return ERR_PTR(PTR_ERR(attach)); | 280 | return ERR_PTR(PTR_ERR(attach)); |
282 | 281 | ||
282 | get_dma_buf(dma_buf); | ||
283 | |||
283 | sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); | 284 | sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); |
284 | if (IS_ERR_OR_NULL(sgt)) { | 285 | if (IS_ERR_OR_NULL(sgt)) { |
285 | ret = PTR_ERR(sgt); | 286 | ret = PTR_ERR(sgt); |
@@ -300,6 +301,8 @@ fail_unmap: | |||
300 | dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL); | 301 | dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL); |
301 | fail_detach: | 302 | fail_detach: |
302 | dma_buf_detach(dma_buf, attach); | 303 | dma_buf_detach(dma_buf, attach); |
304 | dma_buf_put(dma_buf); | ||
305 | |||
303 | return ERR_PTR(ret); | 306 | return ERR_PTR(ret); |
304 | } | 307 | } |
305 | EXPORT_SYMBOL(drm_gem_prime_import); | 308 | EXPORT_SYMBOL(drm_gem_prime_import); |
@@ -342,6 +345,9 @@ int drm_gem_prime_fd_to_handle(struct drm_device *dev, | |||
342 | goto fail; | 345 | goto fail; |
343 | 346 | ||
344 | mutex_unlock(&file_priv->prime.lock); | 347 | mutex_unlock(&file_priv->prime.lock); |
348 | |||
349 | dma_buf_put(dma_buf); | ||
350 | |||
345 | return 0; | 351 | return 0; |
346 | 352 | ||
347 | fail: | 353 | fail: |