drm: omapdrm: Take GEM object reference when exporting dmabuf
authorLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Mon, 8 May 2017 18:59:24 +0000 (21:59 +0300)
committerTomi Valkeinen <tomi.valkeinen@ti.com>
Fri, 2 Jun 2017 07:57:08 +0000 (10:57 +0300)
To ensure that neither the GEM object nor the DRM device goes away while
a GEM object exported through dma-buf is still accessible, references
must be taken to both the GEM object and the DRM device at export time.
The dma-buf release handler already releases the GEM object, but the
export handler doesn't take a corresponding reference, which results in
a refcount underflow.

Fix this by replacing the custom implementation by
drm_gem_dmabuf_export() and drm_gem_dmabuf_release() that handle
reference counting for us.

Fixes: 6ad11bc3a0b8 ("staging: drm/omap: dmabuf/prime support")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c

index 6ab6f52..863a881 100644 (file)
@@ -72,16 +72,6 @@ static void omap_gem_unmap_dma_buf(struct dma_buf_attachment *attachment,
        kfree(sg);
 }
 
-static void omap_gem_dmabuf_release(struct dma_buf *buffer)
-{
-       struct drm_gem_object *obj = buffer->priv;
-       /* release reference that was taken when dmabuf was exported
-        * in omap_gem_prime_set()..
-        */
-       drm_gem_object_unreference_unlocked(obj);
-}
-
-
 static int omap_gem_dmabuf_begin_cpu_access(struct dma_buf *buffer,
                enum dma_data_direction dir)
 {
@@ -157,7 +147,7 @@ static int omap_gem_dmabuf_mmap(struct dma_buf *buffer,
 static struct dma_buf_ops omap_dmabuf_ops = {
        .map_dma_buf = omap_gem_map_dma_buf,
        .unmap_dma_buf = omap_gem_unmap_dma_buf,
-       .release = omap_gem_dmabuf_release,
+       .release = drm_gem_dmabuf_release,
        .begin_cpu_access = omap_gem_dmabuf_begin_cpu_access,
        .end_cpu_access = omap_gem_dmabuf_end_cpu_access,
        .map_atomic = omap_gem_dmabuf_kmap_atomic,
@@ -177,7 +167,7 @@ struct dma_buf *omap_gem_prime_export(struct drm_device *dev,
        exp_info.flags = flags;
        exp_info.priv = obj;
 
-       return dma_buf_export(&exp_info);
+       return drm_gem_dmabuf_export(dev, &exp_info);
 }
 
 /* -----------------------------------------------------------------------------