From patchwork Tue Apr 9 12:08:09 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Imre Deak X-Patchwork-Id: 2414771 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by patchwork1.kernel.org (Postfix) with ESMTP id D50143FC71 for ; Tue, 9 Apr 2013 12:08:25 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 901E9E6076 for ; Tue, 9 Apr 2013 05:08:25 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by gabe.freedesktop.org (Postfix) with ESMTP id 62354E5BF0; Tue, 9 Apr 2013 05:08:14 -0700 (PDT) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga102.fm.intel.com with ESMTP; 09 Apr 2013 05:08:14 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.87,438,1363158000"; d="scan'208";a="316545812" Received: from intelbox.fi.intel.com (HELO localhost) ([10.237.72.157]) by fmsmga001.fm.intel.com with ESMTP; 09 Apr 2013 05:08:13 -0700 From: Imre Deak To: intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org Subject: [PATCH 2/2] drm: prime: fix lookup of existing imports for self imported buffers Date: Tue, 9 Apr 2013 15:08:09 +0300 Message-Id: <1365509289-11796-2-git-send-email-imre.deak@intel.com> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1365509289-11796-1-git-send-email-imre.deak@intel.com> References: <1365509289-11796-1-git-send-email-imre.deak@intel.com> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Since atm we don't take a reference on the dma buf pointer when we add it to the import lookup table the dma buf can vanish leaving the stale pointer behind. This can in turn lead to returning stale GEM handles when userspace imports a newly exported buffer. Fix this by keeping a reference on the dma buffer whenever we have a pointer to it in the lookup table. Reference: https://bugs.freedesktop.org/show_bug.cgi?id=59229 Signed-off-by: Imre Deak --- drivers/gpu/drm/drm_prime.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index bba45f6..e4e1a69 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -501,6 +501,7 @@ int drm_prime_add_imported_buf_handle(struct drm_prime_file_private *prime_fpriv if (!member) return -ENOMEM; + get_dma_buf(dma_buf); member->dma_buf = dma_buf; member->handle = handle; list_add(&member->entry, &prime_fpriv->head); @@ -529,6 +530,7 @@ void drm_prime_remove_imported_buf_handle(struct drm_prime_file_private *prime_f mutex_lock(&prime_fpriv->lock); list_for_each_entry_safe(member, safe, &prime_fpriv->head, entry) { if (member->dma_buf == dma_buf) { + dma_buf_put(dma_buf); list_del(&member->entry); kfree(member); }