From: Thomas Zimmermann <tzimmermann@suse.de>
To: simona@ffwll.ch, airlied@gmail.com, christian.koenig@amd.com,
torvalds@linux-foundation.org, maarten.lankhorst@linux.intel.com,
mripard@kernel.org, l.stach@pengutronix.de,
linux+etnaviv@armlinux.org.uk, kraxel@redhat.com,
christian.gmeiner@gmail.com, dmitry.osipenko@collabora.com,
gurchetansingh@chromium.org, olvaffe@gmail.com,
zack.rusin@broadcom.com
Cc: bcm-kernel-feedback-list@broadcom.com,
dri-devel@lists.freedesktop.org, etnaviv@lists.freedesktop.org,
virtualization@lists.linux.dev, intel-gfx@lists.freedesktop.org,
Thomas Zimmermann <tzimmermann@suse.de>,
Simona Vetter <simona.vetter@ffwll.ch>
Subject: [PATCH v3 3/7] Revert "drm/etnaviv: Use dma_buf from GEM object instance"
Date: Tue, 15 Jul 2025 17:58:13 +0200 [thread overview]
Message-ID: <20250715155934.150656-4-tzimmermann@suse.de> (raw)
In-Reply-To: <20250715155934.150656-1-tzimmermann@suse.de>
This reverts commit e91eb3ae415472b28211d7fed07fa283845b311e.
The dma_buf field in struct drm_gem_object is not stable over the
object instance's lifetime. The field becomes NULL when user space
releases the final GEM handle on the buffer object. This resulted
in a NULL-pointer deref.
Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
Acquire internal references on GEM handles") only solved the problem
partially. They especially don't work for buffer objects without a DRM
framebuffer associated.
Hence, this revert to going back to using .import_attach->dmabuf.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
Acked-by: Christian König <christian.koenig@amd.com>
---
drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
index 917ad527c961..40a50c60dfff 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -65,7 +65,7 @@ static void etnaviv_gem_prime_release(struct etnaviv_gem_object *etnaviv_obj)
struct iosys_map map = IOSYS_MAP_INIT_VADDR(etnaviv_obj->vaddr);
if (etnaviv_obj->vaddr)
- dma_buf_vunmap_unlocked(etnaviv_obj->base.dma_buf, &map);
+ dma_buf_vunmap_unlocked(etnaviv_obj->base.import_attach->dmabuf, &map);
/* Don't drop the pages for imported dmabuf, as they are not
* ours, just free the array we allocated:
@@ -82,7 +82,7 @@ static void *etnaviv_gem_prime_vmap_impl(struct etnaviv_gem_object *etnaviv_obj)
lockdep_assert_held(&etnaviv_obj->lock);
- ret = dma_buf_vmap(etnaviv_obj->base.dma_buf, &map);
+ ret = dma_buf_vmap(etnaviv_obj->base.import_attach->dmabuf, &map);
if (ret)
return NULL;
return map.vaddr;
--
2.50.0
next prev parent reply other threads:[~2025-07-15 16:02 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-15 15:58 [PATCH v3 0/7] drm: Revert general use of struct drm_gem_object.dma_buf Thomas Zimmermann
2025-07-15 15:58 ` [PATCH v3 1/7] Revert "drm/virtio: Use dma_buf from GEM object instance" Thomas Zimmermann
2025-07-15 15:58 ` [PATCH v3 2/7] Revert "drm/vmwgfx: " Thomas Zimmermann
2025-07-15 15:58 ` Thomas Zimmermann [this message]
2025-07-15 15:58 ` [PATCH v3 4/7] Revert "drm/prime: " Thomas Zimmermann
2025-07-15 15:58 ` [PATCH v3 5/7] Revert "drm/gem-framebuffer: " Thomas Zimmermann
2025-07-15 15:58 ` [PATCH v3 6/7] Revert "drm/gem-shmem: " Thomas Zimmermann
2025-07-15 15:58 ` [PATCH v3 7/7] Revert "drm/gem-dma: " Thomas Zimmermann
2025-07-15 18:15 ` [PATCH v3 0/7] drm: Revert general use of struct drm_gem_object.dma_buf Zack Rusin
2025-07-15 21:22 ` ✓ i915.CI.BAT: success for drm: Revert general use of struct drm_gem_object.dma_buf (rev3) Patchwork
2025-07-16 7:40 ` ✗ i915.CI.Full: failure " Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250715155934.150656-4-tzimmermann@suse.de \
--to=tzimmermann@suse.de \
--cc=airlied@gmail.com \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=christian.gmeiner@gmail.com \
--cc=christian.koenig@amd.com \
--cc=dmitry.osipenko@collabora.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=etnaviv@lists.freedesktop.org \
--cc=gurchetansingh@chromium.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=kraxel@redhat.com \
--cc=l.stach@pengutronix.de \
--cc=linux+etnaviv@armlinux.org.uk \
--cc=maarten.lankhorst@linux.intel.com \
--cc=mripard@kernel.org \
--cc=olvaffe@gmail.com \
--cc=simona.vetter@ffwll.ch \
--cc=simona@ffwll.ch \
--cc=torvalds@linux-foundation.org \
--cc=virtualization@lists.linux.dev \
--cc=zack.rusin@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.