]>
Commit | Line | Data |
---|---|---|
21af5a80 GKH |
1 | From 23e35c0eb81a23d40c079a7eb187fc321fa1deb7 Mon Sep 17 00:00:00 2001 |
2 | From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org> | |
3 | Date: Fri, 26 Apr 2019 14:47:53 +0200 | |
4 | Subject: drm/cma-helper: Fix drm_gem_cma_free_object() | |
5 | MIME-Version: 1.0 | |
6 | Content-Type: text/plain; charset=UTF-8 | |
7 | Content-Transfer-Encoding: 8bit | |
8 | ||
9 | From: Noralf Trønnes <noralf@tronnes.org> | |
10 | ||
11 | commit 23e35c0eb81a23d40c079a7eb187fc321fa1deb7 upstream. | |
12 | ||
13 | The logic for freeing an imported buffer with a virtual address is | |
14 | broken. It will free the buffer instead of unmapping the dma buf. | |
15 | Fix by reversing the if ladder and first check if the buffer is imported. | |
16 | ||
17 | Fixes: b9068cde51ee ("drm/cma-helper: Add DRM_GEM_CMA_VMAP_DRIVER_OPS") | |
18 | Cc: stable@vger.kernel.org | |
19 | Reported-by: "Li, Tingqian" <tingqian.li@intel.com> | |
20 | Signed-off-by: Noralf Trønnes <noralf@tronnes.org> | |
21 | Reviewed-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com> | |
22 | Link: https://patchwork.freedesktop.org/patch/msgid/20190426124753.53722-1-noralf@tronnes.org | |
23 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
24 | ||
25 | --- | |
26 | drivers/gpu/drm/drm_gem_cma_helper.c | 8 ++++---- | |
27 | 1 file changed, 4 insertions(+), 4 deletions(-) | |
28 | ||
29 | --- a/drivers/gpu/drm/drm_gem_cma_helper.c | |
30 | +++ b/drivers/gpu/drm/drm_gem_cma_helper.c | |
31 | @@ -186,13 +186,13 @@ void drm_gem_cma_free_object(struct drm_ | |
32 | ||
33 | cma_obj = to_drm_gem_cma_obj(gem_obj); | |
34 | ||
35 | - if (cma_obj->vaddr) { | |
36 | - dma_free_wc(gem_obj->dev->dev, cma_obj->base.size, | |
37 | - cma_obj->vaddr, cma_obj->paddr); | |
38 | - } else if (gem_obj->import_attach) { | |
39 | + if (gem_obj->import_attach) { | |
40 | if (cma_obj->vaddr) | |
41 | dma_buf_vunmap(gem_obj->import_attach->dmabuf, cma_obj->vaddr); | |
42 | drm_prime_gem_destroy(gem_obj, cma_obj->sgt); | |
43 | + } else if (cma_obj->vaddr) { | |
44 | + dma_free_wc(gem_obj->dev->dev, cma_obj->base.size, | |
45 | + cma_obj->vaddr, cma_obj->paddr); | |
46 | } | |
47 | ||
48 | drm_gem_object_release(gem_obj); |