Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 648a4ce7 authored by Daniel Vetter's avatar Daniel Vetter
Browse files

drm/rockchip: Don't grab dev->struct_mutex for in mmap offset ioctl 



Since David Herrmann's mmap vma manager rework we don't need to grab
dev->struct_mutex any more to prevent races when looking up the mmap
offset. Drop it and instead don't forget to use the unref_unlocked
variant (since the drm core still cares).

Aside: I stumbled over the mmap handler which directly does a
dma_mmap_attrs. But totally fails to grab a reference on the
underlying object and hence looks like it happily just leaks the ptes
since there's no guarantee the mmap isn't still around when
gem_free_object is called. Which the kerneldoc of dma_mmap_attrs
explicitly forbids.

v2: Fixup compile fail 0-day spotted.

Cc: Mark Yao <mark.yao@rock-chips.com>
Reviewed-by: default avatarThierry Reding <treding@nvidia.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
parent 141518b6

drivers/gpu/drm/rockchip/rockchip_drm_gem.c

+4 −8
Original line number Original line Diff line number Diff line
@@ -200,13 +200,10 @@ int rockchip_gem_dumb_map_offset(struct drm_file *file_priv, 
	struct drm_gem_object *obj;

	struct drm_gem_object *obj;

	int ret;

	int ret;





	mutex_lock(&dev->struct_mutex);



	obj = drm_gem_object_lookup(dev, file_priv, handle);

	obj = drm_gem_object_lookup(dev, file_priv, handle);

	if (!obj) {

	if (!obj) {

		DRM_ERROR("failed to lookup gem object.\n");

		DRM_ERROR("failed to lookup gem object.\n");

		ret = -EINVAL;

		return -EINVAL;

		goto unlock;

	}

	}





	ret = drm_gem_create_mmap_offset(obj);

	ret = drm_gem_create_mmap_offset(obj);
@@ -217,10 +214,9 @@ int rockchip_gem_dumb_map_offset(struct drm_file *file_priv, 
	DRM_DEBUG_KMS("offset = 0x%llx\n", *offset);

	DRM_DEBUG_KMS("offset = 0x%llx\n", *offset);





out:

out:

	drm_gem_object_unreference(obj);

	drm_gem_object_unreference_unlocked(obj);

unlock:



	mutex_unlock(&dev->struct_mutex);

	return 0;

	return ret;

}

}





/*

/*