github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/msm/gem: Fix dma_buf import error paths

Browse Source 
Set import_attach early, so that if we hit an error path
msm_gem_free_object() goes down the drm_gem_is_imported()
path.

Set sgt late so _free_object() skips drm_prime_gem_destroy()
as this is done by drm_gem_prime_import_dev().

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/743084/
Message-ID: <20260729155609.20190-10-robin.clark@oss.qualcomm.com>
This commit is contained in:
Rob Clark 2026-07-29 08:55:46 -07:00
parent 517ca9a86a
commit e6863b0856
3 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/gpu/drm/msm/msm_gem.c
View File

@ -1093,7 +1093,9 @@ static void msm_gem_free_object(struct drm_gem_object *obj)
*/
kvfree(msm_obj->pages);
drm_prime_gem_destroy(obj, msm_obj->sgt);
/* In msm_gem_import() error path, sgt won't be set yet: */
if (msm_obj->sgt)
drm_prime_gem_destroy(obj, msm_obj->sgt);
} else {
msm_gem_vunmap(obj);
put_pages(obj);
@ -1282,11 +1284,13 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev, size_t size, uint32_t
}
struct drm_gem_object *msm_gem_import(struct drm_device *dev,
struct dma_buf *dmabuf, struct sg_table *sgt)
struct dma_buf_attachment *attach,
struct sg_table *sgt)
{
struct msm_drm_private *priv = dev->dev_private;
struct msm_gem_object *msm_obj;
struct drm_gem_object *obj;
struct dma_buf *dmabuf = attach->dmabuf;
size_t size, npages;
int ret;
@ -1296,13 +1300,17 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
if (ret)
return ERR_PTR(ret);
/*
* Set import_attach here in case we hit an error path that ends
* up in drm_gem_object_put() -> msm_gem_free_object()
*/
obj->import_attach = attach;
drm_gem_private_object_init(dev, obj, size);
npages = size / PAGE_SIZE;
msm_obj = to_msm_bo(obj);
msm_gem_lock(obj);
msm_obj->sgt = sgt;
msm_obj->pages = kvmalloc_objs(struct page *, npages);
if (!msm_obj->pages) {
msm_gem_unlock(obj);
@ -1328,6 +1336,9 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
if (ret)
goto fail;
/* Now that we are past potential failure points, set sgt: */
msm_obj->sgt = sgt;
return obj;
fail:

3
drivers/gpu/drm/msm/msm_gem.h
View File

@ -302,7 +302,8 @@ void *msm_gem_kernel_new(struct drm_device *dev, size_t size, uint32_t flags,
uint64_t *iova);
void msm_gem_kernel_put(struct drm_gem_object *bo, struct drm_gpuvm *vm);
struct drm_gem_object *msm_gem_import(struct drm_device *dev,
struct dma_buf *dmabuf, struct sg_table *sgt);
struct dma_buf_attachment *attach,
struct sg_table *sgt);
__printf(2, 3)
void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...);

2
drivers/gpu/drm/msm/msm_gem_prime.c
View File

@ -83,7 +83,7 @@ struct drm_gem_object *msm_gem_prime_import(struct drm_device *dev,
struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
struct dma_buf_attachment *attach, struct sg_table *sg)
{
return msm_gem_import(dev, attach->dmabuf, sg);
return msm_gem_import(dev, attach, sg);
}
struct dma_buf *msm_gem_prime_export(struct drm_gem_object *obj, int flags)