Commit 681066ec authored by Christian König's avatar Christian König Committed by Alex Deucher
Browse files

drm/prime: fix potential race in drm_gem_map_detach 



Unpin the GEM object only after freeing the sg table.

Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: default avatarRoger He <Hongbo.He@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180227115000.4105-1-christian.koenig@amd.com
parent 5ebbb5b4

drivers/gpu/drm/drm_prime.c

+16 −16
Original line number Diff line number Diff line
@@ -230,18 +230,14 @@ void drm_gem_map_detach(struct dma_buf *dma_buf, 
	struct drm_prime_attachment *prime_attach = attach->priv;

	struct drm_gem_object *obj = dma_buf->priv;

	struct drm_device *dev = obj->dev;

	struct sg_table *sgt;



	if (dev->driver->gem_prime_unpin)

		dev->driver->gem_prime_unpin(obj);



	if (!prime_attach)

		return;

	if (prime_attach) {

		struct sg_table *sgt = prime_attach->sgt;



	sgt = prime_attach->sgt;

		if (sgt) {

			if (prime_attach->dir != DMA_NONE)

			dma_unmap_sg_attrs(attach->dev, sgt->sgl, sgt->nents,

				dma_unmap_sg_attrs(attach->dev, sgt->sgl,

						   sgt->nents,

						   prime_attach->dir,

						   DMA_ATTR_SKIP_CPU_SYNC);

			sg_free_table(sgt);
@@ -251,6 +247,10 @@ void drm_gem_map_detach(struct dma_buf *dma_buf, 
		kfree(prime_attach);

		attach->priv = NULL;

	}



	if (dev->driver->gem_prime_unpin)

		dev->driver->gem_prime_unpin(obj);

}

EXPORT_SYMBOL(drm_gem_map_detach);



void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpriv,

CRA Git | Maintained and supported by SUSTech CRA and CCSE