drm: prime: fix refcounting on the dmabuf import error path

[platform/adaptation/renesas_rcar/renesas_kernel.git] / drivers / gpu / drm / i915 / i915_gem_dmabuf.c

diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index 6a5af68..30485e9 100644 (file)
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -62,7 +62,7 @@ static struct sg_table *i915_gem_map_dma_buf(struct dma_buf_attachment *attachme
        src = obj->pages->sgl;
        dst = st->sgl;
        for (i = 0; i < obj->pages->nents; i++) {
-               sg_set_page(dst, sg_page(src), PAGE_SIZE, 0);
+               sg_set_page(dst, sg_page(src), src->length, 0);
                dst = sg_next(dst);
                src = sg_next(src);
        }
@@ -105,7 +105,7 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
 {
        struct drm_i915_gem_object *obj = dma_buf->priv;
        struct drm_device *dev = obj->base.dev;
-       struct scatterlist *sg;
+       struct sg_page_iter sg_iter;
        struct page **pages;
        int ret, i;
 
@@ -124,14 +124,15 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
 
        ret = -ENOMEM;
 
-       pages = drm_malloc_ab(obj->pages->nents, sizeof(struct page *));
+       pages = drm_malloc_ab(obj->base.size >> PAGE_SHIFT, sizeof(*pages));
        if (pages == NULL)
                goto error;
 
-       for_each_sg(obj->pages->sgl, sg, obj->pages->nents, i)
-               pages[i] = sg_page(sg);
+       i = 0;
+       for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0);
+               pages[i++] = sg_page_iter_page(&sg_iter);
 
-       obj->dma_buf_vmapping = vmap(pages, obj->pages->nents, 0, PAGE_KERNEL);
+       obj->dma_buf_vmapping = vmap(pages, i, 0, PAGE_KERNEL);
        drm_free_large(pages);
 
        if (!obj->dma_buf_vmapping)
@@ -271,7 +272,6 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
                         * refcount on gem itself instead of f_count of dmabuf.
                         */
                        drm_gem_object_reference(&obj->base);
-                       dma_buf_put(dma_buf);
                        return &obj->base;
                }
        }
@@ -281,6 +281,8 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
        if (IS_ERR(attach))
                return ERR_CAST(attach);
 
+       get_dma_buf(dma_buf);
+
        obj = i915_gem_object_alloc(dev);
        if (obj == NULL) {
                ret = -ENOMEM;
@@ -300,5 +302,7 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
 
 fail_detach:
        dma_buf_detach(dma_buf, attach);
+       dma_buf_put(dma_buf);
+
        return ERR_PTR(ret);
 }