@@ -541,13 +541,18 @@ armada_gem_prime_export(struct drm_device *dev, struct drm_gem_object *obj,
int flags)
{
DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+ struct dma_buf *dma_buf;
exp_info.ops = &armada_gem_prime_dmabuf_ops;
exp_info.size = obj->size;
- exp_info.flags = O_RDWR;
+ exp_info.flags = flags;
exp_info.priv = obj;
- return dma_buf_export(&exp_info);
+ dma_buf = dma_buf_export(&exp_info);
+ if (!IS_ERR(dma_buf))
+ drm_dev_ref(dev);
+
+ return dma_buf;
}
struct drm_gem_object *
@@ -293,9 +293,12 @@ static void drm_gem_unmap_dma_buf(struct dma_buf_attachment *attach,
void drm_gem_dmabuf_release(struct dma_buf *dma_buf)
{
struct drm_gem_object *obj = dma_buf->priv;
+ struct drm_device *dev = obj->dev;
/* drop the reference on the export fd holds */
drm_gem_object_unreference_unlocked(obj);
+
+ drm_dev_unref(dev);
}
EXPORT_SYMBOL(drm_gem_dmabuf_release);
@@ -413,11 +416,16 @@ struct dma_buf *drm_gem_prime_export(struct drm_device *dev,
.flags = flags,
.priv = obj,
};
+ struct dma_buf *dma_buf;
if (dev->driver->gem_prime_res_obj)
exp_info.resv = dev->driver->gem_prime_res_obj(obj);
- return dma_buf_export(&exp_info);
+ dma_buf = dma_buf_export(&exp_info);
+ if (!IS_ERR(dma_buf))
+ drm_dev_ref(dev);
+
+ return dma_buf;
}
EXPORT_SYMBOL(drm_gem_prime_export);
@@ -288,6 +288,7 @@ struct dma_buf *i915_gem_prime_export(struct drm_device *dev,
return dma_buf;
export_fences(obj, dma_buf);
+ drm_dev_ref(obj->base.dev);
return dma_buf;
}
@@ -607,13 +607,18 @@ struct dma_buf *tegra_gem_prime_export(struct drm_device *drm,
int flags)
{
DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+ struct dma_buf *dma_buf;
exp_info.ops = &tegra_gem_prime_dmabuf_ops;
exp_info.size = gem->size;
exp_info.flags = flags;
exp_info.priv = gem;
- return dma_buf_export(&exp_info);
+ dma_buf = dma_buf_export(&exp_info);
+ if (!IS_ERR(dma_buf))
+ drm_dev_ref(drm);
+
+ return dma_buf;
}
struct drm_gem_object *tegra_gem_prime_import(struct drm_device *drm,
@@ -203,13 +203,18 @@ struct dma_buf *udl_gem_prime_export(struct drm_device *dev,
struct drm_gem_object *obj, int flags)
{
DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+ struct dma_buf *dma_buf;
exp_info.ops = &udl_dmabuf_ops;
exp_info.size = obj->size;
exp_info.flags = flags;
exp_info.priv = obj;
- return dma_buf_export(&exp_info);
+ dma_buf = dma_buf_export(&exp_info);
+ if (!IS_ERR(dma_buf))
+ drm_dev_ref(dev);
+
+ return dma_buf;
}
static int udl_prime_create(struct drm_device *dev,
dma_buf may live a long time, longer than the last direct user of the driver. We already hold a reference to the owner module (that prevents the object code from disappearing), but there is no reference to the drm_dev - so the pointers to the driver backend themselves may vanish. Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Petri Latvala <petri.latvala@intel.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: stable@vger.kernel.org --- drivers/gpu/drm/armada/armada_gem.c | 9 +++++++-- drivers/gpu/drm/drm_prime.c | 10 +++++++++- drivers/gpu/drm/i915/i915_gem_dmabuf.c | 1 + drivers/gpu/drm/tegra/gem.c | 7 ++++++- drivers/gpu/drm/udl/udl_dmabuf.c | 7 ++++++- 5 files changed, 29 insertions(+), 5 deletions(-)