Commit 036d2072 authored by Rob Clark's avatar Rob Clark
Browse files

drm/msm: Ensure mmap offset is initialized 



If a GEM object is allocated, and then exported as a dma-buf fd which is
mmap'd before or without the GEM buffer being directly mmap'd, the
vma_node could be unitialized.  This leads to a situation where the CPU
mapping is not correctly torn down in drm_vma_node_unmap().

Fixes: e5516553 ("drm: call drm_gem_object_funcs.mmap with fake offset")
Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20220531200857.136547-1-robdclark@gmail.com
parent af0f2a8c

drivers/gpu/drm/msm/msm_drv.c

+1 −1
Original line number Diff line number Diff line
@@ -964,7 +964,7 @@ static const struct drm_driver msm_driver = { 
	.prime_handle_to_fd = drm_gem_prime_handle_to_fd,

	.prime_fd_to_handle = drm_gem_prime_fd_to_handle,

	.gem_prime_import_sg_table = msm_gem_prime_import_sg_table,

	.gem_prime_mmap     = drm_gem_prime_mmap,

	.gem_prime_mmap     = msm_gem_prime_mmap,

#ifdef CONFIG_DEBUG_FS

	.debugfs_init       = msm_debugfs_init,

#endif

drivers/gpu/drm/msm/msm_drv.h

+1 −0
Original line number Diff line number Diff line
@@ -246,6 +246,7 @@ unsigned long msm_gem_shrinker_shrink(struct drm_device *dev, unsigned long nr_t 
void msm_gem_shrinker_init(struct drm_device *dev);

void msm_gem_shrinker_cleanup(struct drm_device *dev);



int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma);

struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj);

int msm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map);

void msm_gem_prime_vunmap(struct drm_gem_object *obj, struct iosys_map *map);

drivers/gpu/drm/msm/msm_gem_prime.c

+15 −0
Original line number Diff line number Diff line
@@ -11,6 +11,21 @@ 
#include "msm_drv.h"

#include "msm_gem.h"



int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma)

{

	int ret;



	/* Ensure the mmap offset is initialized.  We lazily initialize it,

	 * so if it has not been first mmap'd directly as a GEM object, the

	 * mmap offset will not be already initialized.

	 */

	ret = drm_gem_create_mmap_offset(obj);

	if (ret)

		return ret;



	return drm_gem_prime_mmap(obj, vma);

}



struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)

{

	struct msm_gem_object *msm_obj = to_msm_bo(obj);