From patchwork Fri Apr 26 12:47:53 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Noralf_Tr=C3=B8nnes?= X-Patchwork-Id: 10919103 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EAFAE1390 for ; Fri, 26 Apr 2019 12:48:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D65EA28BD5 for ; Fri, 26 Apr 2019 12:48:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C7A2828B22; Fri, 26 Apr 2019 12:48:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5304928B22 for ; Fri, 26 Apr 2019 12:48:49 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id BF5C4892B2; Fri, 26 Apr 2019 12:48:46 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from smtp.domeneshop.no (smtp.domeneshop.no [IPv6:2a01:5b40:0:3005::1]) by gabe.freedesktop.org (Postfix) with ESMTPS id 43EF1892B2 for ; Fri, 26 Apr 2019 12:48:45 +0000 (UTC) Received: from 211.81-166-168.customer.lyse.net ([81.166.168.211]:49970 helo=localhost.localdomain) by smtp.domeneshop.no with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.84_2) (envelope-from ) id 1hK0HT-0007Ub-Eo; Fri, 26 Apr 2019 14:48:43 +0200 From: =?utf-8?q?Noralf_Tr=C3=B8nnes?= To: dri-devel@lists.freedesktop.org Subject: [PATCH] drm/cma-helper: Fix drm_gem_cma_free_object() Date: Fri, 26 Apr 2019 14:47:53 +0200 Message-Id: <20190426124753.53722-1-noralf@tronnes.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=tronnes.org; s=ds201810; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-Id:Date:Subject:Cc:To:From; bh=/eEP8I6EI4KCGV9ZyL84p0EVM81ngvIp1nYu4yhqYec=; b=B+s9VAFeN0uv6yMl+Kl4Q4ad3e9TIHQhH8X5uWqLVXwnE/u6uaEW43mgsDFSrA3CkMjrWue6RY8L545sdmiW1Pqdm04lgdQhHBo8UHx/OG6rNmWQE0Gp6JeGSopyZEN8DcoZfCJ/5CGOdJ4b93ORvXb71M+ZZ19vEtA4W/QCynrc1HgHwHvuUmMp4Mju4q38P44FLaU/qXRSnwjA4D+nU4X1WoBEqA9DjbZqLf3fBn9BCpZrVlrRyj8yw1+O3pmzjfwSVdnIDrKtJvjE56sTDF26DM+MG7OVGjLZySyfRMPlhwLlfxlKnD9L+mCxhqHawPaprXrLpuw9tqaBfMWt+A==; X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Li, Tingqian" , stable@vger.kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP The logic for freeing an imported buffer with a virtual address is broken. It will free the buffer instead of unmapping the dma buf. Fix by reversing the if ladder and first check if the buffer is imported. Fixes: b9068cde51ee ("drm/cma-helper: Add DRM_GEM_CMA_VMAP_DRIVER_OPS") Cc: stable@vger.kernel.org Reported-by: "Li, Tingqian" Signed-off-by: Noralf Trønnes Reviewed-by: Oleksandr Andrushchenko --- This bug is present in 5.0 and it only affects tinydrm drivers that import buffers, which is rare if anyone at all is doing it. I'll apply this to drm-misc-next and let it trickle down through stable unless someone thinks otherwise. Noralf. drivers/gpu/drm/drm_gem_cma_helper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_cma_helper.c b/drivers/gpu/drm/drm_gem_cma_helper.c index cc26625b4b33..e01ceed09e67 100644 --- a/drivers/gpu/drm/drm_gem_cma_helper.c +++ b/drivers/gpu/drm/drm_gem_cma_helper.c @@ -186,13 +186,13 @@ void drm_gem_cma_free_object(struct drm_gem_object *gem_obj) cma_obj = to_drm_gem_cma_obj(gem_obj); - if (cma_obj->vaddr) { - dma_free_wc(gem_obj->dev->dev, cma_obj->base.size, - cma_obj->vaddr, cma_obj->paddr); - } else if (gem_obj->import_attach) { + if (gem_obj->import_attach) { if (cma_obj->vaddr) dma_buf_vunmap(gem_obj->import_attach->dmabuf, cma_obj->vaddr); drm_prime_gem_destroy(gem_obj, cma_obj->sgt); + } else if (cma_obj->vaddr) { + dma_free_wc(gem_obj->dev->dev, cma_obj->base.size, + cma_obj->vaddr, cma_obj->paddr); } drm_gem_object_release(gem_obj);