[PATCH] drm/exynos: Convert from atomic_t to refcount_t on g2d_cmdlist_userptr->refcount

[Xiyu Yang]

refcount_t type and corresponding API can protect refcounters from
accidental underflow and overflow and further use-after-free situations.

Signed-off-by: Xiyu Yang <xiyuyan...@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin....@gmail.com>
---
 drivers/gpu/drm/exynos/exynos_drm_g2d.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c 
b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index cab4d2c370a7..4921e84c374d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -4,6 +4,7 @@
  * Authors: Joonyoung Shim <jy0922.s...@samsung.com>
  */
 
+#include <linux/refcount.h>
 #include <linux/clk.h>
 #include <linux/component.h>
 #include <linux/delay.h>
@@ -208,7 +209,7 @@ struct g2d_cmdlist_userptr {
        struct page             **pages;
        unsigned int            npages;
        struct sg_table         *sgt;
-       atomic_t                refcount;
+       refcount_t              refcount;
        bool                    in_pool;
        bool                    out_of_list;
 };
@@ -386,9 +387,9 @@ static void g2d_userptr_put_dma_addr(struct g2d_data *g2d,
        if (force)
                goto out;
 
-       atomic_dec(&g2d_userptr->refcount);
+       refcount_dec(&g2d_userptr->refcount);
 
-       if (atomic_read(&g2d_userptr->refcount) > 0)
+       if (refcount_read(&g2d_userptr->refcount) > 0)
                return;
 
        if (g2d_userptr->in_pool)
@@ -436,7 +437,7 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct g2d_data 
*g2d,
                         * and different size.
                         */
                        if (g2d_userptr->size == size) {
-                               atomic_inc(&g2d_userptr->refcount);
+                               refcount_inc(&g2d_userptr->refcount);
                                *obj = g2d_userptr;
 
                                return &g2d_userptr->dma_addr;
@@ -461,7 +462,7 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct g2d_data 
*g2d,
        if (!g2d_userptr)
                return ERR_PTR(-ENOMEM);
 
-       atomic_set(&g2d_userptr->refcount, 1);
+       refcount_set(&g2d_userptr->refcount, 1);
        g2d_userptr->size = size;
 
        start = userptr & PAGE_MASK;
-- 
2.7.4