From 47d35c1c40d53411d77d214644e12734901c553c Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Fri, 15 Jan 2021 10:30:38 +0100 Subject: [PATCH] drm: Set vm_ops to GEM object's values during mmap The GEM mmap code relies on the GEM object's mmap callback to set the VMA's vm_ops field. This is easily forgotten and already led to a memory leak in the CMA helpers. Instead set the vm_ops field in the DRM core code to the GEM object's value. Drivers with different needs can override this in their mmap callback. v2: * support (vm_ops == NULL) if mmap is given; required by VRAM helpers Signed-off-by: Thomas Zimmermann Fixes: f5ca8eb6f9bd ("drm/cma-helper: Implement mmap as GEM CMA object functions") Reviewed-by: Daniel Vetter Reported-by: Kieran Bingham Tested-by: Kieran Bingham Cc: Maxime Ripard Cc: Maarten Lankhorst Cc: David Airlie Cc: Daniel Vetter Cc: Eric Anholt Cc: dri-devel@lists.freedesktop.org Link: https://patchwork.freedesktop.org/patch/msgid/20210115093038.10345-1-tzimmermann@suse.de --- drivers/gpu/drm/drm_gem.c | 19 ++++++++++--------- drivers/gpu/drm/drm_prime.c | 2 ++ 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 34b2f111c01c1..c2ce78c4edc3e 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -1068,20 +1068,17 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size, drm_gem_object_get(obj); vma->vm_private_data = obj; + vma->vm_ops = obj->funcs->vm_ops; if (obj->funcs->mmap) { ret = obj->funcs->mmap(obj, vma); - if (ret) { - drm_gem_object_put(obj); - return ret; - } + if (ret) + goto err_drm_gem_object_put; WARN_ON(!(vma->vm_flags & VM_DONTEXPAND)); } else { - if (obj->funcs->vm_ops) - vma->vm_ops = obj->funcs->vm_ops; - else { - drm_gem_object_put(obj); - return -EINVAL; + if (!vma->vm_ops) { + ret = -EINVAL; + goto err_drm_gem_object_put; } vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; @@ -1090,6 +1087,10 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size, } return 0; + +err_drm_gem_object_put: + drm_gem_object_put(obj); + return ret; } EXPORT_SYMBOL(drm_gem_mmap_obj); diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 683aa29ecd3b7..2a54f86856afe 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -717,6 +717,8 @@ int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) vma->vm_pgoff += drm_vma_node_start(&obj->vma_node); if (obj->funcs && obj->funcs->mmap) { + vma->vm_ops = obj->funcs->vm_ops; + ret = obj->funcs->mmap(obj, vma); if (ret) return ret; -- 2.30.2