[PATCH 3/3] drm/prime: add return check for dma_buf_fd

[Seung-Woo Kim]

From: YoungJun Cho <yj44....@samsung.com>

The dma_buf_fd() can return error when it fails to prepare fd,
so the dma_buf needs to be put.

Signed-off-by: YoungJun Cho <yj44....@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312....@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.p...@samsung.com>
---
 drivers/gpu/drm/drm_prime.c |   39 ++++++++++++++++++++++++++++-----------
 1 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index b3bb2fb..24c801c 100644
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -79,6 +79,21 @@ static int drm_prime_add_buf_handle(struct 
drm_prime_file_private *prime_fpriv,
        return 0;
 }
 
+static void drm_prime_remove_buf_handle_locked(
+               struct drm_prime_file_private *prime_fpriv,
+               struct dma_buf *dma_buf)
+{
+       struct drm_prime_member *member, *safe;
+
+       list_for_each_entry_safe(member, safe, &prime_fpriv->head, entry) {
+               if (member->dma_buf == dma_buf) {
+                       dma_buf_put(dma_buf);
+                       list_del(&member->entry);
+                       kfree(member);
+               }
+       }
+}
+
 static struct sg_table *drm_gem_map_dma_buf(struct dma_buf_attachment *attach,
                enum dma_data_direction dir)
 {
@@ -252,15 +267,25 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev,
        if (ret)
                goto fail_put_dmabuf;
 
-       *prime_fd = dma_buf_fd(buf, flags);
+       ret = dma_buf_fd(buf, flags);
+       if (ret < 0)
+               goto fail_rm_handle;
+
+       *prime_fd = ret;
        mutex_unlock(&file_priv->prime.lock);
        return 0;
 
 out_have_obj:
        get_dma_buf(dmabuf);
-       *prime_fd = dma_buf_fd(dmabuf, flags);
+       ret = dma_buf_fd(dmabuf, flags);
+       if (ret < 0)
+               dma_buf_put(dmabuf);
+       else
+               *prime_fd = ret;
        goto out;
 
+fail_rm_handle:
+       drm_prime_remove_buf_handle_locked(&file_priv->prime, buf);
 fail_put_dmabuf:
        /* clear NOT to be checked when releasing dma_buf */
        obj->export_dma_buf = NULL;
@@ -529,16 +554,8 @@ EXPORT_SYMBOL(drm_prime_lookup_buf_handle);
 
 void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv, 
struct dma_buf *dma_buf)
 {
-       struct drm_prime_member *member, *safe;
-
        mutex_lock(&prime_fpriv->lock);
-       list_for_each_entry_safe(member, safe, &prime_fpriv->head, entry) {
-               if (member->dma_buf == dma_buf) {
-                       dma_buf_put(dma_buf);
-                       list_del(&member->entry);
-                       kfree(member);
-               }
-       }
+       drm_prime_remove_buf_handle_locked(prime_fpriv, dma_buf);
        mutex_unlock(&prime_fpriv->lock);
 }
 EXPORT_SYMBOL(drm_prime_remove_buf_handle);
-- 
1.7.4.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel