drm/msm/gem: Fix dma_buf import error paths

Set import_attach early, so that if we hit an error path
msm_gem_free_object() goes down the drm_gem_is_imported()
path.

Set sgt late so _free_object() skips drm_prime_gem_destroy()
as this is done by drm_gem_prime_import_dev().

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/743084/
Message-ID: <20260729155609.20190-10-robin.clark@oss.qualcomm.com>

diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index efd3d3c9a4490cb232331732bf899e23cb2f6d22..74c3728f45bd08ac86c7b257f51d1493d1c75b52 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -1093,7 +1093,9 @@ static void msm_gem_free_object(struct drm_gem_object *obj)
                 */
                kvfree(msm_obj->pages);
 
-               drm_prime_gem_destroy(obj, msm_obj->sgt);
+               /* In msm_gem_import() error path, sgt won't be set yet: */
+               if (msm_obj->sgt)
+                       drm_prime_gem_destroy(obj, msm_obj->sgt);
        } else {
                msm_gem_vunmap(obj);
                put_pages(obj);
@@ -1282,11 +1284,13 @@ fail:
 }
 
 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
-               struct dma_buf *dmabuf, struct sg_table *sgt)
+                                     struct dma_buf_attachment *attach,
+                                     struct sg_table *sgt)
 {
        struct msm_drm_private *priv = dev->dev_private;
        struct msm_gem_object *msm_obj;
        struct drm_gem_object *obj;
+       struct dma_buf *dmabuf = attach->dmabuf;
        size_t size, npages;
        int ret;
 
@@ -1296,13 +1300,17 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
        if (ret)
                return ERR_PTR(ret);
 
+       /*
+        * Set import_attach here in case we hit an error path that ends
+        * up in drm_gem_object_put() -> msm_gem_free_object()
+        */
+       obj->import_attach = attach;
        drm_gem_private_object_init(dev, obj, size);
 
        npages = size / PAGE_SIZE;
 
        msm_obj = to_msm_bo(obj);
        msm_gem_lock(obj);
-       msm_obj->sgt = sgt;
        msm_obj->pages = kvmalloc_objs(struct page *, npages);
        if (!msm_obj->pages) {
                msm_gem_unlock(obj);
@@ -1328,6 +1336,9 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
        if (ret)
                goto fail;
 
+       /* Now that we are past potential failure points, set sgt: */
+       msm_obj->sgt = sgt;
+
        return obj;
 
 fail:

diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h
index 762e546d25ef35ce5f3961a6c26110a62f2c8689..86dc93cc1804876779b54e5819f304e533d0ca4e 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem.h
+++ b/drivers/gpu/drm/msm/msm_gem.h
@@ -302,7 +302,8 @@ void *msm_gem_kernel_new(struct drm_device *dev, size_t size, uint32_t flags,
                         uint64_t *iova);
 void msm_gem_kernel_put(struct drm_gem_object *bo, struct drm_gpuvm *vm);
 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
-               struct dma_buf *dmabuf, struct sg_table *sgt);
+                                     struct dma_buf_attachment *attach,
+                                     struct sg_table *sgt);
 __printf(2, 3)
 void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...);
 

diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
index 036d34c674d9a25da849d257332deae7a905628c..beb7f22fd6948d2df9b9eae1bb5be8c4b0e48ead 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem_prime.c
+++ b/drivers/gpu/drm/msm/msm_gem_prime.c
@@ -83,7 +83,7 @@ struct drm_gem_object *msm_gem_prime_import(struct drm_device *dev,
 struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
                struct dma_buf_attachment *attach, struct sg_table *sg)
 {
-       return msm_gem_import(dev, attach->dmabuf, sg);
+       return msm_gem_import(dev, attach, sg);
 }
 
 struct dma_buf *msm_gem_prime_export(struct drm_gem_object *obj, int flags)