[PATCH] drm/gem-shmem: Pin and unpin buffers when importing w/o S/G table

[PATCH] drm/gem-shmem: Pin and unpin buffers when importing w/o S/G table

[Thomas Zimmermann]

Imported dma-buf objects need to be pinned while being vmap'ed into
kernel address space. This used to be done before while creating an
S/G table.

GEM-SHMEN can import dma-buf objects without creating the S/G table,
but the pin/unpin is now missing. Leads to page-mapping errors such
as the one shown below.

[  102.101726] BUG: unable to handle page fault for address: ffffc90127000000
[...]
[  102.157102] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]
[...]
[  102.243250] Call Trace:
[  102.245695]  <TASK>
[  102.2477V95]  ? validate_chain+0x24e/0x5e0
[  102.251805]  ? __lock_acquire+0x568/0xae0
[  102.255807]  udl_render_hline+0x165/0x341 [udl]
[  102.260338]  ? __pfx_udl_render_hline+0x10/0x10 [udl]
[  102.265379]  ? local_clock_noinstr+0xb/0x100
[  102.269642]  ? __lock_release.isra.0+0x16c/0x2e0
[  102.274246]  ? mark_held_locks+0x40/0x70
[  102.278177]  udl_primary_plane_helper_atomic_update+0x43e/0x680 [udl]
[  102.284606]  ? __pfx_udl_primary_plane_helper_atomic_update+0x10/0x10 [udl]
[  102.291551]  ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170
[  102.297208]  ? lockdep_hardirqs_on+0x88/0x130
[  102.301554]  ? _raw_spin_unlock_irq+0x24/0x50
[  102.305901]  ? wait_for_completion_timeout+0x2bb/0x3a0
[  102.311028]  ? drm_atomic_helper_calc_timestamping_constants+0x141/0x200
[  102.317714]  ? drm_atomic_helper_commit_planes+0x3b6/0x1030
[  102.323279]  drm_atomic_helper_commit_planes+0x3b6/0x1030
[  102.328664]  drm_atomic_helper_commit_tail+0x41/0xb0
[  102.333622]  commit_tail+0x204/0x330
[...]
[  102.529946] ---[ end trace 0000000000000000 ]---
[  102.651980] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]

Support pin/unpin in drm_buf_map_attachment() without creating an S/G
table. Passing DMA_NONE for the DMA direction will only pin. Do the
inverse for unmap_attachment(). Modify GEM-SHMEM accordingly, so that
it pins the imported dma-buf.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 660cd44659a0 ("drm/shmem-helper: Import dmabuf without mapping its sg_table")
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Closes: https://lore.kernel.org/dri-devel/ba1bdfb8-dbf7-4372-bdcb-df7e0511c702@suse.de/
Cc: Shixiong Ou <oushixiong@kylinos.cn>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-media@vger.kernel.org
Cc: linaro-mm-sig@lists.linaro.org
---
 drivers/dma-buf/dma-buf.c              | 16 +++++++++++++---
 drivers/gpu/drm/drm_gem_shmem_helper.c | 11 ++++++++++-
 drivers/gpu/drm/drm_prime.c            |  2 ++
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 2bcf9ceca997..f1e1385ce630 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1086,7 +1086,8 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, "DMA_BUF");
  * @direction:	[in]	direction of DMA transfer
  *
  * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
- * on error. May return -EINTR if it is interrupted by a signal.
+ * on error. May return -EINTR if it is interrupted by a signal. Returns NULL
+ * on success iff direction is DMA_NONE.
  *
  * On success, the DMA addresses and lengths in the returned scatterlist are
  * PAGE_SIZE aligned.
@@ -1122,6 +1123,8 @@ struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
 		if (ret)
 			return ERR_PTR(ret);
 	}
+	if (!valid_dma_direction(direction))
+		return NULL; /* only pin; don't map */
 
 	sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
 	if (!sg_table)
@@ -1216,14 +1219,21 @@ void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
 {
 	might_sleep();
 
-	if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
+	if (WARN_ON(!attach || !attach->dmabuf))
 		return;
 
 	dma_resv_assert_held(attach->dmabuf->resv);
 
+	if (!valid_dma_direction(direction))
+		goto unpin;
+
+	if (WARN_ON(!sg_table))
+		return;
+
 	mangle_sg_table(sg_table);
 	attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
 
+unpin:
 	if (dma_buf_pin_on_map(attach))
 		attach->dmabuf->ops->unpin(attach);
 }
@@ -1245,7 +1255,7 @@ void dma_buf_unmap_attachment_unlocked(struct dma_buf_attachment *attach,
 {
 	might_sleep();
 
-	if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
+	if (WARN_ON(!attach || !attach->dmabuf))
 		return;
 
 	dma_resv_lock(attach->dmabuf->resv, NULL);
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index 5d1349c34afd..1b66501420d3 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -817,6 +817,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
 							 struct dma_buf *dma_buf)
 {
 	struct dma_buf_attachment *attach;
+	struct sg_table *sgt;
 	struct drm_gem_shmem_object *shmem;
 	struct drm_gem_object *obj;
 	size_t size;
@@ -838,12 +839,18 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
 
 	get_dma_buf(dma_buf);
 
+	sgt = dma_buf_map_attachment_unlocked(attach, DMA_NONE);
+	if (IS_ERR(sgt)) {
+		ret = PTR_ERR(sgt);
+		goto fail_detach;
+	}
+
 	size = PAGE_ALIGN(attach->dmabuf->size);
 
 	shmem = __drm_gem_shmem_create(dev, size, true, NULL);
 	if (IS_ERR(shmem)) {
 		ret = PTR_ERR(shmem);
-		goto fail_detach;
+		goto fail_unmap;
 	}
 
 	drm_dbg_prime(dev, "size = %zu\n", size);
@@ -853,6 +860,8 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
 
 	return &shmem->base;
 
+fail_unmap:
+	dma_buf_unmap_attachment_unlocked(attach, sgt, DMA_NONE);
 fail_detach:
 	dma_buf_detach(dma_buf, attach);
 	dma_buf_put(dma_buf);
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index 43a10b4af43a..b3b070868e3b 100644
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -1109,6 +1109,8 @@ void drm_prime_gem_destroy(struct drm_gem_object *obj, struct sg_table *sg)
 	attach = obj->import_attach;
 	if (sg)
 		dma_buf_unmap_attachment_unlocked(attach, sg, DMA_BIDIRECTIONAL);
+	else
+		dma_buf_unmap_attachment_unlocked(attach, NULL, DMA_NONE);
 	dma_buf = attach->dmabuf;
 	dma_buf_detach(attach->dmabuf, attach);
 	/* remove the reference */
-- 
2.50.1

Re: [PATCH] drm/gem-shmem: Pin and unpin buffers when importing w/o S/G table

[Thomas Zimmermann]

FYI this patch got feedback at

https://lore.kernel.org/dri-devel/805acaca-3b91-438d-b842-25c055fd898c@amd.com/

Preferably the problem should be addressed on GEM/PRIME code instead of 
dma-buf.

Best regards
Thomas

Am 14.08.25 um 09:34 schrieb Thomas Zimmermann:
> Imported dma-buf objects need to be pinned while being vmap'ed into
> kernel address space. This used to be done before while creating an
> S/G table.
>
> GEM-SHMEN can import dma-buf objects without creating the S/G table,
> but the pin/unpin is now missing. Leads to page-mapping errors such
> as the one shown below.
>
> [  102.101726] BUG: unable to handle page fault for address: ffffc90127000000
> [...]
> [  102.157102] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]
> [...]
> [  102.243250] Call Trace:
> [  102.245695]  <TASK>
> [  102.2477V95]  ? validate_chain+0x24e/0x5e0
> [  102.251805]  ? __lock_acquire+0x568/0xae0
> [  102.255807]  udl_render_hline+0x165/0x341 [udl]
> [  102.260338]  ? __pfx_udl_render_hline+0x10/0x10 [udl]
> [  102.265379]  ? local_clock_noinstr+0xb/0x100
> [  102.269642]  ? __lock_release.isra.0+0x16c/0x2e0
> [  102.274246]  ? mark_held_locks+0x40/0x70
> [  102.278177]  udl_primary_plane_helper_atomic_update+0x43e/0x680 [udl]
> [  102.284606]  ? __pfx_udl_primary_plane_helper_atomic_update+0x10/0x10 [udl]
> [  102.291551]  ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170
> [  102.297208]  ? lockdep_hardirqs_on+0x88/0x130
> [  102.301554]  ? _raw_spin_unlock_irq+0x24/0x50
> [  102.305901]  ? wait_for_completion_timeout+0x2bb/0x3a0
> [  102.311028]  ? drm_atomic_helper_calc_timestamping_constants+0x141/0x200
> [  102.317714]  ? drm_atomic_helper_commit_planes+0x3b6/0x1030
> [  102.323279]  drm_atomic_helper_commit_planes+0x3b6/0x1030
> [  102.328664]  drm_atomic_helper_commit_tail+0x41/0xb0
> [  102.333622]  commit_tail+0x204/0x330
> [...]
> [  102.529946] ---[ end trace 0000000000000000 ]---
> [  102.651980] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]
>
> Support pin/unpin in drm_buf_map_attachment() without creating an S/G
> table. Passing DMA_NONE for the DMA direction will only pin. Do the
> inverse for unmap_attachment(). Modify GEM-SHMEM accordingly, so that
> it pins the imported dma-buf.
>
> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> Fixes: 660cd44659a0 ("drm/shmem-helper: Import dmabuf without mapping its sg_table")
> Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
> Closes: https://lore.kernel.org/dri-devel/ba1bdfb8-dbf7-4372-bdcb-df7e0511c702@suse.de/
> Cc: Shixiong Ou <oushixiong@kylinos.cn>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Maxime Ripard <mripard@kernel.org>
> Cc: David Airlie <airlied@gmail.com>
> Cc: Simona Vetter <simona@ffwll.ch>
> Cc: Sumit Semwal <sumit.semwal@linaro.org>
> Cc: "Christian König" <christian.koenig@amd.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-media@vger.kernel.org
> Cc: linaro-mm-sig@lists.linaro.org
> ---
>   drivers/dma-buf/dma-buf.c              | 16 +++++++++++++---
>   drivers/gpu/drm/drm_gem_shmem_helper.c | 11 ++++++++++-
>   drivers/gpu/drm/drm_prime.c            |  2 ++
>   3 files changed, 25 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
> index 2bcf9ceca997..f1e1385ce630 100644
> --- a/drivers/dma-buf/dma-buf.c
> +++ b/drivers/dma-buf/dma-buf.c
> @@ -1086,7 +1086,8 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, "DMA_BUF");
>    * @direction:	[in]	direction of DMA transfer
>    *
>    * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
> - * on error. May return -EINTR if it is interrupted by a signal.
> + * on error. May return -EINTR if it is interrupted by a signal. Returns NULL
> + * on success iff direction is DMA_NONE.
>    *
>    * On success, the DMA addresses and lengths in the returned scatterlist are
>    * PAGE_SIZE aligned.
> @@ -1122,6 +1123,8 @@ struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
>   		if (ret)
>   			return ERR_PTR(ret);
>   	}
> +	if (!valid_dma_direction(direction))
> +		return NULL; /* only pin; don't map */
>   
>   	sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
>   	if (!sg_table)
> @@ -1216,14 +1219,21 @@ void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
>   {
>   	might_sleep();
>   
> -	if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
> +	if (WARN_ON(!attach || !attach->dmabuf))
>   		return;
>   
>   	dma_resv_assert_held(attach->dmabuf->resv);
>   
> +	if (!valid_dma_direction(direction))
> +		goto unpin;
> +
> +	if (WARN_ON(!sg_table))
> +		return;
> +
>   	mangle_sg_table(sg_table);
>   	attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
>   
> +unpin:
>   	if (dma_buf_pin_on_map(attach))
>   		attach->dmabuf->ops->unpin(attach);
>   }
> @@ -1245,7 +1255,7 @@ void dma_buf_unmap_attachment_unlocked(struct dma_buf_attachment *attach,
>   {
>   	might_sleep();
>   
> -	if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
> +	if (WARN_ON(!attach || !attach->dmabuf))
>   		return;
>   
>   	dma_resv_lock(attach->dmabuf->resv, NULL);
> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
> index 5d1349c34afd..1b66501420d3 100644
> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
> @@ -817,6 +817,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>   							 struct dma_buf *dma_buf)
>   {
>   	struct dma_buf_attachment *attach;
> +	struct sg_table *sgt;
>   	struct drm_gem_shmem_object *shmem;
>   	struct drm_gem_object *obj;
>   	size_t size;
> @@ -838,12 +839,18 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>   
>   	get_dma_buf(dma_buf);
>   
> +	sgt = dma_buf_map_attachment_unlocked(attach, DMA_NONE);
> +	if (IS_ERR(sgt)) {
> +		ret = PTR_ERR(sgt);
> +		goto fail_detach;
> +	}
> +
>   	size = PAGE_ALIGN(attach->dmabuf->size);
>   
>   	shmem = __drm_gem_shmem_create(dev, size, true, NULL);
>   	if (IS_ERR(shmem)) {
>   		ret = PTR_ERR(shmem);
> -		goto fail_detach;
> +		goto fail_unmap;
>   	}
>   
>   	drm_dbg_prime(dev, "size = %zu\n", size);
> @@ -853,6 +860,8 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>   
>   	return &shmem->base;
>   
> +fail_unmap:
> +	dma_buf_unmap_attachment_unlocked(attach, sgt, DMA_NONE);
>   fail_detach:
>   	dma_buf_detach(dma_buf, attach);
>   	dma_buf_put(dma_buf);
> diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
> index 43a10b4af43a..b3b070868e3b 100644
> --- a/drivers/gpu/drm/drm_prime.c
> +++ b/drivers/gpu/drm/drm_prime.c
> @@ -1109,6 +1109,8 @@ void drm_prime_gem_destroy(struct drm_gem_object *obj, struct sg_table *sg)
>   	attach = obj->import_attach;
>   	if (sg)
>   		dma_buf_unmap_attachment_unlocked(attach, sg, DMA_BIDIRECTIONAL);
> +	else
> +		dma_buf_unmap_attachment_unlocked(attach, NULL, DMA_NONE);
>   	dma_buf = attach->dmabuf;
>   	dma_buf_detach(attach->dmabuf, attach);
>   	/* remove the reference */

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)

Re: [PATCH] drm/gem-shmem: Pin and unpin buffers when importing w/o S/G table

[Thomas Zimmermann]

Am 15.08.25 um 08:02 schrieb Thomas Zimmermann:
> FYI this patch got feedback at
>
> https://lore.kernel.org/dri-devel/805acaca-3b91-438d-b842-25c055fd898c@amd.com/ 
>
>
> Preferably the problem should be addressed on GEM/PRIME code instead 
> of dma-buf.

Follow-up patch is at 
https://lore.kernel.org/dri-devel/20250818084148.212443-1-tzimmermann@suse.de/

>
> Best regards
> Thomas
>
> Am 14.08.25 um 09:34 schrieb Thomas Zimmermann:
>> Imported dma-buf objects need to be pinned while being vmap'ed into
>> kernel address space. This used to be done before while creating an
>> S/G table.
>>
>> GEM-SHMEN can import dma-buf objects without creating the S/G table,
>> but the pin/unpin is now missing. Leads to page-mapping errors such
>> as the one shown below.
>>
>> [  102.101726] BUG: unable to handle page fault for address: 
>> ffffc90127000000
>> [...]
>> [  102.157102] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]
>> [...]
>> [  102.243250] Call Trace:
>> [  102.245695]  <TASK>
>> [  102.2477V95]  ? validate_chain+0x24e/0x5e0
>> [  102.251805]  ? __lock_acquire+0x568/0xae0
>> [  102.255807]  udl_render_hline+0x165/0x341 [udl]
>> [  102.260338]  ? __pfx_udl_render_hline+0x10/0x10 [udl]
>> [  102.265379]  ? local_clock_noinstr+0xb/0x100
>> [  102.269642]  ? __lock_release.isra.0+0x16c/0x2e0
>> [  102.274246]  ? mark_held_locks+0x40/0x70
>> [  102.278177] udl_primary_plane_helper_atomic_update+0x43e/0x680 [udl]
>> [  102.284606]  ? 
>> __pfx_udl_primary_plane_helper_atomic_update+0x10/0x10 [udl]
>> [  102.291551]  ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170
>> [  102.297208]  ? lockdep_hardirqs_on+0x88/0x130
>> [  102.301554]  ? _raw_spin_unlock_irq+0x24/0x50
>> [  102.305901]  ? wait_for_completion_timeout+0x2bb/0x3a0
>> [  102.311028]  ? 
>> drm_atomic_helper_calc_timestamping_constants+0x141/0x200
>> [  102.317714]  ? drm_atomic_helper_commit_planes+0x3b6/0x1030
>> [  102.323279]  drm_atomic_helper_commit_planes+0x3b6/0x1030
>> [  102.328664]  drm_atomic_helper_commit_tail+0x41/0xb0
>> [  102.333622]  commit_tail+0x204/0x330
>> [...]
>> [  102.529946] ---[ end trace 0000000000000000 ]---
>> [  102.651980] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]
>>
>> Support pin/unpin in drm_buf_map_attachment() without creating an S/G
>> table. Passing DMA_NONE for the DMA direction will only pin. Do the
>> inverse for unmap_attachment(). Modify GEM-SHMEM accordingly, so that
>> it pins the imported dma-buf.
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Fixes: 660cd44659a0 ("drm/shmem-helper: Import dmabuf without mapping 
>> its sg_table")
>> Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Closes: 
>> https://lore.kernel.org/dri-devel/ba1bdfb8-dbf7-4372-bdcb-df7e0511c702@suse.de/
>> Cc: Shixiong Ou <oushixiong@kylinos.cn>
>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>> Cc: Maxime Ripard <mripard@kernel.org>
>> Cc: David Airlie <airlied@gmail.com>
>> Cc: Simona Vetter <simona@ffwll.ch>
>> Cc: Sumit Semwal <sumit.semwal@linaro.org>
>> Cc: "Christian König" <christian.koenig@amd.com>
>> Cc: dri-devel@lists.freedesktop.org
>> Cc: linux-media@vger.kernel.org
>> Cc: linaro-mm-sig@lists.linaro.org
>> ---
>>   drivers/dma-buf/dma-buf.c              | 16 +++++++++++++---
>>   drivers/gpu/drm/drm_gem_shmem_helper.c | 11 ++++++++++-
>>   drivers/gpu/drm/drm_prime.c            |  2 ++
>>   3 files changed, 25 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
>> index 2bcf9ceca997..f1e1385ce630 100644
>> --- a/drivers/dma-buf/dma-buf.c
>> +++ b/drivers/dma-buf/dma-buf.c
>> @@ -1086,7 +1086,8 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, "DMA_BUF");
>>    * @direction:    [in]    direction of DMA transfer
>>    *
>>    * Returns sg_table containing the scatterlist to be returned; 
>> returns ERR_PTR
>> - * on error. May return -EINTR if it is interrupted by a signal.
>> + * on error. May return -EINTR if it is interrupted by a signal. 
>> Returns NULL
>> + * on success iff direction is DMA_NONE.
>>    *
>>    * On success, the DMA addresses and lengths in the returned 
>> scatterlist are
>>    * PAGE_SIZE aligned.
>> @@ -1122,6 +1123,8 @@ struct sg_table *dma_buf_map_attachment(struct 
>> dma_buf_attachment *attach,
>>           if (ret)
>>               return ERR_PTR(ret);
>>       }
>> +    if (!valid_dma_direction(direction))
>> +        return NULL; /* only pin; don't map */
>>         sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
>>       if (!sg_table)
>> @@ -1216,14 +1219,21 @@ void dma_buf_unmap_attachment(struct 
>> dma_buf_attachment *attach,
>>   {
>>       might_sleep();
>>   -    if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
>> +    if (WARN_ON(!attach || !attach->dmabuf))
>>           return;
>>         dma_resv_assert_held(attach->dmabuf->resv);
>>   +    if (!valid_dma_direction(direction))
>> +        goto unpin;
>> +
>> +    if (WARN_ON(!sg_table))
>> +        return;
>> +
>>       mangle_sg_table(sg_table);
>>       attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
>>   +unpin:
>>       if (dma_buf_pin_on_map(attach))
>>           attach->dmabuf->ops->unpin(attach);
>>   }
>> @@ -1245,7 +1255,7 @@ void dma_buf_unmap_attachment_unlocked(struct 
>> dma_buf_attachment *attach,
>>   {
>>       might_sleep();
>>   -    if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
>> +    if (WARN_ON(!attach || !attach->dmabuf))
>>           return;
>>         dma_resv_lock(attach->dmabuf->resv, NULL);
>> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c 
>> b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> index 5d1349c34afd..1b66501420d3 100644
>> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
>> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> @@ -817,6 +817,7 @@ struct drm_gem_object 
>> *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>>                                struct dma_buf *dma_buf)
>>   {
>>       struct dma_buf_attachment *attach;
>> +    struct sg_table *sgt;
>>       struct drm_gem_shmem_object *shmem;
>>       struct drm_gem_object *obj;
>>       size_t size;
>> @@ -838,12 +839,18 @@ struct drm_gem_object 
>> *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>>         get_dma_buf(dma_buf);
>>   +    sgt = dma_buf_map_attachment_unlocked(attach, DMA_NONE);
>> +    if (IS_ERR(sgt)) {
>> +        ret = PTR_ERR(sgt);
>> +        goto fail_detach;
>> +    }
>> +
>>       size = PAGE_ALIGN(attach->dmabuf->size);
>>         shmem = __drm_gem_shmem_create(dev, size, true, NULL);
>>       if (IS_ERR(shmem)) {
>>           ret = PTR_ERR(shmem);
>> -        goto fail_detach;
>> +        goto fail_unmap;
>>       }
>>         drm_dbg_prime(dev, "size = %zu\n", size);
>> @@ -853,6 +860,8 @@ struct drm_gem_object 
>> *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>>         return &shmem->base;
>>   +fail_unmap:
>> +    dma_buf_unmap_attachment_unlocked(attach, sgt, DMA_NONE);
>>   fail_detach:
>>       dma_buf_detach(dma_buf, attach);
>>       dma_buf_put(dma_buf);
>> diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
>> index 43a10b4af43a..b3b070868e3b 100644
>> --- a/drivers/gpu/drm/drm_prime.c
>> +++ b/drivers/gpu/drm/drm_prime.c
>> @@ -1109,6 +1109,8 @@ void drm_prime_gem_destroy(struct 
>> drm_gem_object *obj, struct sg_table *sg)
>>       attach = obj->import_attach;
>>       if (sg)
>>           dma_buf_unmap_attachment_unlocked(attach, sg, 
>> DMA_BIDIRECTIONAL);
>> +    else
>> +        dma_buf_unmap_attachment_unlocked(attach, NULL, DMA_NONE);
>>       dma_buf = attach->dmabuf;
>>       dma_buf_detach(attach->dmabuf, attach);
>>       /* remove the reference */
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)