diff options
author | Imre Deak <imre.deak@intel.com> | 2013-04-18 21:11:56 -0400 |
---|---|---|
committer | Dave Airlie <airlied@redhat.com> | 2013-04-30 19:40:21 -0400 |
commit | 011c2282c74db120f01a8414edc66c3f217f5511 (patch) | |
tree | 5e43eb6b5d21e8aa29e88f0398fcdd7ca55abdb5 /drivers/gpu/drm/exynos | |
parent | 219b47339ced80ca580bb6ce7d1636166984afa7 (diff) |
drm: prime: fix refcounting on the dmabuf import error path
In commit be8a42ae60 we inroduced a refcount problem, where on the
drm_gem_prime_fd_to_handle() error path we'll call dma_buf_put() for
self imported dma buffers.
Fix this by taking a reference on the dma buffer in the .gem_import
hook instead of assuming the caller had taken one. Besides fixing the
bug this is also more logical.
Signed-off-by: Imre Deak <imre.deak@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/exynos')
-rw-r--r-- | drivers/gpu/drm/exynos/exynos_drm_dmabuf.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c index ba0a3aa78547..ff7f2a886a34 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c +++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c | |||
@@ -235,7 +235,6 @@ struct drm_gem_object *exynos_dmabuf_prime_import(struct drm_device *drm_dev, | |||
235 | * refcount on gem itself instead of f_count of dmabuf. | 235 | * refcount on gem itself instead of f_count of dmabuf. |
236 | */ | 236 | */ |
237 | drm_gem_object_reference(obj); | 237 | drm_gem_object_reference(obj); |
238 | dma_buf_put(dma_buf); | ||
239 | return obj; | 238 | return obj; |
240 | } | 239 | } |
241 | } | 240 | } |
@@ -244,6 +243,7 @@ struct drm_gem_object *exynos_dmabuf_prime_import(struct drm_device *drm_dev, | |||
244 | if (IS_ERR(attach)) | 243 | if (IS_ERR(attach)) |
245 | return ERR_PTR(-EINVAL); | 244 | return ERR_PTR(-EINVAL); |
246 | 245 | ||
246 | get_dma_buf(dma_buf); | ||
247 | 247 | ||
248 | sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); | 248 | sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); |
249 | if (IS_ERR_OR_NULL(sgt)) { | 249 | if (IS_ERR_OR_NULL(sgt)) { |
@@ -298,6 +298,8 @@ err_unmap_attach: | |||
298 | dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL); | 298 | dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL); |
299 | err_buf_detach: | 299 | err_buf_detach: |
300 | dma_buf_detach(dma_buf, attach); | 300 | dma_buf_detach(dma_buf, attach); |
301 | dma_buf_put(dma_buf); | ||
302 | |||
301 | return ERR_PTR(ret); | 303 | return ERR_PTR(ret); |
302 | } | 304 | } |
303 | 305 | ||