[PATCH v2] drm: Set vm_ops to GEM object's values during mmap

[Thomas Zimmermann]

The GEM mmap code relies on the GEM object's mmap callback to set the
VMA's vm_ops field. This is easily forgotten and already led to a memory
leak in the CMA helpers. Instead set the vm_ops field in the DRM core
code to the GEM object's value. Drivers with different needs can override
this in their mmap callback.

v2:
        * support (vm_ops == NULL) if mmap is given; required by VRAM
          helpers

Signed-off-by: Thomas Zimmermann <tzimmerm...@suse.de>
Fixes: f5ca8eb6f9bd ("drm/cma-helper: Implement mmap as GEM CMA object 
functions")
Reported-by: Kieran Bingham <kieran.bingham+rene...@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham+rene...@ideasonboard.com>
Cc: Maxime Ripard <mrip...@kernel.org>
Cc: Maarten Lankhorst <maarten.lankho...@linux.intel.com>
Cc: David Airlie <airl...@linux.ie>
Cc: Daniel Vetter <dan...@ffwll.ch>
Cc: Eric Anholt <e...@anholt.net>
Cc: dri-devel@lists.freedesktop.org
---
 drivers/gpu/drm/drm_gem.c   | 19 ++++++++++---------
 drivers/gpu/drm/drm_prime.c |  2 ++
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 34b2f111c01c..c2ce78c4edc3 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1068,20 +1068,17 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, 
unsigned long obj_size,
        drm_gem_object_get(obj);
 
        vma->vm_private_data = obj;
+       vma->vm_ops = obj->funcs->vm_ops;
 
        if (obj->funcs->mmap) {
                ret = obj->funcs->mmap(obj, vma);
-               if (ret) {
-                       drm_gem_object_put(obj);
-                       return ret;
-               }
+               if (ret)
+                       goto err_drm_gem_object_put;
                WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));
        } else {
-               if (obj->funcs->vm_ops)
-                       vma->vm_ops = obj->funcs->vm_ops;
-               else {
-                       drm_gem_object_put(obj);
-                       return -EINVAL;
+               if (!vma->vm_ops) {
+                       ret = -EINVAL;
+                       goto err_drm_gem_object_put;
                }
 
                vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | 
VM_DONTDUMP;
@@ -1090,6 +1087,10 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, 
unsigned long obj_size,
        }
 
        return 0;
+
+err_drm_gem_object_put:
+       drm_gem_object_put(obj);
+       return ret;
 }
 EXPORT_SYMBOL(drm_gem_mmap_obj);
 
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index 683aa29ecd3b..2a54f86856af 100644
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -717,6 +717,8 @@ int drm_gem_prime_mmap(struct drm_gem_object *obj, struct 
vm_area_struct *vma)
        vma->vm_pgoff += drm_vma_node_start(&obj->vma_node);
 
        if (obj->funcs && obj->funcs->mmap) {
+               vma->vm_ops = obj->funcs->vm_ops;
+
                ret = obj->funcs->mmap(obj, vma);
                if (ret)
                        return ret;
-- 
2.29.2

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel