| Message ID | 20230228165552.760988-1-l.stach@pengutronix.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/etnaviv: fix reference leak when mmaping imported buffer | expand |
> > drm_gem_prime_mmap() takes a reference on the GEM object, but before that > drm_gem_mmap_obj() already takes a reference, which will be leaked as only > one reference is dropped when the mapping is closed. Drop the extra > reference when dma_buf_mmap() succeeds. > > Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com> > --- > drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > index 7031db145a77..3524b5811682 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > @@ -91,7 +91,15 @@ static void *etnaviv_gem_prime_vmap_impl(struct etnaviv_gem_object *etnaviv_obj) > static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj, > struct vm_area_struct *vma) > { > - return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); > + int ret; > + > + ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); > + if (!ret) { > + /* Drop the reference acquired by drm_gem_mmap_obj(). */ > + drm_gem_object_put(&etnaviv_obj->base); > + } > + > + return ret; > } > > static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = { > -- > 2.30.2 >
On 2/28/23 19:55, Lucas Stach wrote: > drm_gem_prime_mmap() takes a reference on the GEM object, but before that > drm_gem_mmap_obj() already takes a reference, which will be leaked as only > one reference is dropped when the mapping is closed. Drop the extra > reference when dma_buf_mmap() succeeds. > > Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Fixes tag missing
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c index 7031db145a77..3524b5811682 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c @@ -91,7 +91,15 @@ static void *etnaviv_gem_prime_vmap_impl(struct etnaviv_gem_object *etnaviv_obj) static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj, struct vm_area_struct *vma) { - return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); + int ret; + + ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); + if (!ret) { + /* Drop the reference acquired by drm_gem_mmap_obj(). */ + drm_gem_object_put(&etnaviv_obj->base); + } + + return ret; } static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = {
drm_gem_prime_mmap() takes a reference on the GEM object, but before that drm_gem_mmap_obj() already takes a reference, which will be leaked as only one reference is dropped when the mapping is closed. Drop the extra reference when dma_buf_mmap() succeeds. Signed-off-by: Lucas Stach <l.stach@pengutronix.de> --- drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)