* Re: [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3)
2026-05-12 19:56 [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3) syzbot
@ 2026-05-12 21:17 ` Hillf Danton
2026-05-12 21:44 ` syzbot
2026-05-13 3:13 ` Hillf Danton
` (2 subsequent siblings)
3 siblings, 1 reply; 8+ messages in thread
From: Hillf Danton @ 2026-05-12 21:17 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Tue, 12 May 2026 12:56:33 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 81d6f7807536 Merge tag 'v7.1-rc3-smb3-client-fixes' of git..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=159b10c8580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=59da38148f3a3d24
> dashboard link: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12332a73980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=161a3dba580000
Test Edward's fix.
#syz test
--- x/drivers/gpu/drm/drm_gem.c
+++ y/drivers/gpu/drm/drm_gem.c
@@ -374,14 +374,8 @@ drm_gem_object_release_handle(int id, vo
if (obj->funcs->close)
obj->funcs->close(obj, file_priv);
- mutex_lock(&file_priv->prime.lock);
-
drm_prime_remove_buf_handle(&file_priv->prime, id);
-
- mutex_unlock(&file_priv->prime.lock);
-
drm_vma_node_revoke(&obj->vma_node, file_priv);
-
drm_gem_object_handle_put_unlocked(obj);
return 0;
@@ -401,13 +395,16 @@ drm_gem_handle_delete(struct drm_file *f
{
struct drm_gem_object *obj;
+ mutex_lock(&filp->prime.lock);
spin_lock(&filp->table_lock);
/* Check if we currently have a reference on the object */
obj = idr_replace(&filp->object_idr, NULL, handle);
spin_unlock(&filp->table_lock);
- if (IS_ERR_OR_NULL(obj))
+ if (IS_ERR_OR_NULL(obj)) {
+ mutex_unlock(&filp->prime.lock);
return -EINVAL;
+ }
/* Release driver's reference and decrement refcount. */
drm_gem_object_release_handle(handle, obj, filp);
@@ -416,6 +413,7 @@ drm_gem_handle_delete(struct drm_file *f
spin_lock(&filp->table_lock);
idr_remove(&filp->object_idr, handle);
spin_unlock(&filp->table_lock);
+ mutex_unlock(&filp->prime.lock);
return 0;
}
@@ -1030,17 +1028,18 @@ int drm_gem_change_handle_ioctl(struct d
return -EINVAL;
handle = args->new_handle;
+ mutex_lock(&file_priv->prime.lock);
obj = drm_gem_object_lookup(file_priv, args->handle);
- if (!obj)
+ if (!obj) {
+ mutex_unlock(&file_priv->prime.lock);
return -ENOENT;
+ }
if (args->handle == handle) {
ret = 0;
- goto out;
+ goto out_unlock;
}
- mutex_lock(&file_priv->prime.lock);
-
spin_lock(&file_priv->table_lock);
/* When create_tail allocs an obj idr, it needs to first alloc as NULL,
@@ -1092,9 +1091,8 @@ int drm_gem_change_handle_ioctl(struct d
spin_unlock(&file_priv->table_lock);
out_unlock:
- mutex_unlock(&file_priv->prime.lock);
-out:
drm_gem_object_put(obj);
+ mutex_unlock(&file_priv->prime.lock);
return ret;
}
@@ -1126,8 +1124,10 @@ drm_gem_open(struct drm_device *dev, str
void
drm_gem_release(struct drm_device *dev, struct drm_file *file_private)
{
+ mutex_lock(&file_private->prime.lock);
idr_for_each(&file_private->object_idr,
&drm_gem_object_release_handle, file_private);
+ mutex_unlock(&file_private->prime.lock);
idr_destroy(&file_private->object_idr);
}
--
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3)
2026-05-12 21:17 ` Hillf Danton
@ 2026-05-12 21:44 ` syzbot
0 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-05-12 21:44 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in drm_prime_destroy_file_private
------------[ cut here ]------------
!RB_EMPTY_ROOT(&prime_fpriv->dmabufs)
WARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/6410
Modules linked in:
CPU: 0 UID: 0 PID: 6410 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 75 2b 48 8b 83 88 00 00 00 48 85 c0 75 0b e8 14 d0 65 fc 5b e9 4e e4 ea 05 e8 09 d0 65 fc 90 <0f> 0b 90 e8 00 d0 65 fc 5b c3 cc cc cc cc e8 95 8e d3 fc eb ce 0f
RSP: 0018:ffffc90002f77c90 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802ad7e328 RCX: ffffffff8b8be29d
RDX: ffff888038710000 RSI: ffffffff85a2d6d7 RDI: ffff88802ad7e3b0
RBP: ffff88802ad7e000 R08: 0000000000000001 R09: fffff520005eef72
R10: ffffc90002f77b97 R11: ffffffff82763704 R12: ffff8880274f6000
R13: ffff88802ad7e260 R14: 0000000000000000 R15: ffff88802ad7e288
FS: 000055555a33f500(0000) GS:ffff888124372000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f33e59e9000 CR3: 000000005f403000 CR4: 00000000003526f0
Call Trace:
<TASK>
drm_file_free.part.0+0x7e6/0xcc0 drivers/gpu/drm/drm_file.c:269
drm_file_free drivers/gpu/drm/drm_file.c:237 [inline]
drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:290
drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:438
__fput+0x3ff/0xb50 fs/file_table.c:510
task_work_run+0x150/0x240 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0x107/0x4f0 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x706/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f33e579cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffece825a08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffece825af0 RCX: 00007f33e579cdd9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000001dd1e R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2c920000 R11: 0000000000000246 R12: 00007ffece825b30
R13: 00007f33e5a15fac R14: 000000000001dd56 R15: 00007f33e5a15fa0
</TASK>
Tested on:
commit: 1d5dcaa3 Merge tag 'probes-fixes-v7.1-rc3' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13d7c7ce580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59da38148f3a3d24
dashboard link: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=1164ebce580000
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3)
2026-05-12 19:56 [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3) syzbot
2026-05-12 21:17 ` Hillf Danton
@ 2026-05-13 3:13 ` Hillf Danton
2026-05-13 4:03 ` syzbot
2026-05-13 3:58 ` Edward Adam Davis
2026-05-13 4:30 ` [PATCH] drm: Replace old pointer to new idr Edward Adam Davis
3 siblings, 1 reply; 8+ messages in thread
From: Hillf Danton @ 2026-05-13 3:13 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Tue, 12 May 2026 12:56:33 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 81d6f7807536 Merge tag 'v7.1-rc3-smb3-client-fixes' of git..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=159b10c8580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=59da38148f3a3d24
> dashboard link: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12332a73980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=161a3dba580000
#syz test
--- x/drivers/gpu/drm/drm_gem.c
+++ y/drivers/gpu/drm/drm_gem.c
@@ -374,14 +374,8 @@ drm_gem_object_release_handle(int id, vo
if (obj->funcs->close)
obj->funcs->close(obj, file_priv);
- mutex_lock(&file_priv->prime.lock);
-
drm_prime_remove_buf_handle(&file_priv->prime, id);
-
- mutex_unlock(&file_priv->prime.lock);
-
drm_vma_node_revoke(&obj->vma_node, file_priv);
-
drm_gem_object_handle_put_unlocked(obj);
return 0;
@@ -401,13 +395,16 @@ drm_gem_handle_delete(struct drm_file *f
{
struct drm_gem_object *obj;
+ mutex_lock(&filp->prime.lock);
spin_lock(&filp->table_lock);
/* Check if we currently have a reference on the object */
obj = idr_replace(&filp->object_idr, NULL, handle);
spin_unlock(&filp->table_lock);
- if (IS_ERR_OR_NULL(obj))
+ if (IS_ERR_OR_NULL(obj)) {
+ mutex_unlock(&filp->prime.lock);
return -EINVAL;
+ }
/* Release driver's reference and decrement refcount. */
drm_gem_object_release_handle(handle, obj, filp);
@@ -416,6 +413,7 @@ drm_gem_handle_delete(struct drm_file *f
spin_lock(&filp->table_lock);
idr_remove(&filp->object_idr, handle);
spin_unlock(&filp->table_lock);
+ mutex_unlock(&filp->prime.lock);
return 0;
}
@@ -1030,17 +1028,18 @@ int drm_gem_change_handle_ioctl(struct d
return -EINVAL;
handle = args->new_handle;
+ mutex_lock(&file_priv->prime.lock);
obj = drm_gem_object_lookup(file_priv, args->handle);
- if (!obj)
+ if (!obj) {
+ mutex_unlock(&file_priv->prime.lock);
return -ENOENT;
+ }
if (args->handle == handle) {
ret = 0;
- goto out;
+ goto out_unlock;
}
- mutex_lock(&file_priv->prime.lock);
-
spin_lock(&file_priv->table_lock);
/* When create_tail allocs an obj idr, it needs to first alloc as NULL,
@@ -1092,9 +1091,8 @@ int drm_gem_change_handle_ioctl(struct d
spin_unlock(&file_priv->table_lock);
out_unlock:
- mutex_unlock(&file_priv->prime.lock);
-out:
drm_gem_object_put(obj);
+ mutex_unlock(&file_priv->prime.lock);
return ret;
}
@@ -1126,8 +1124,10 @@ drm_gem_open(struct drm_device *dev, str
void
drm_gem_release(struct drm_device *dev, struct drm_file *file_private)
{
+ mutex_lock(&file_private->prime.lock);
idr_for_each(&file_private->object_idr,
&drm_gem_object_release_handle, file_private);
+ mutex_unlock(&file_private->prime.lock);
idr_destroy(&file_private->object_idr);
}
--- x/drivers/gpu/drm/drm_file.c
+++ y/drivers/gpu/drm/drm_file.c
@@ -257,8 +257,7 @@ void drm_file_free(struct drm_file *file
if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
drm_syncobj_release(file);
- if (drm_core_check_feature(dev, DRIVER_GEM))
- drm_gem_release(dev, file);
+ drm_gem_release(dev, file);
if (drm_is_primary_client(file))
drm_master_release(file);
--
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3)
2026-05-13 3:13 ` Hillf Danton
@ 2026-05-13 4:03 ` syzbot
0 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-05-13 4:03 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in drm_prime_destroy_file_private
------------[ cut here ]------------
!RB_EMPTY_ROOT(&prime_fpriv->dmabufs)
WARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/6327
Modules linked in:
CPU: 0 UID: 0 PID: 6327 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 75 2b 48 8b 83 88 00 00 00 48 85 c0 75 0b e8 d4 d0 65 fc 5b e9 0e e5 ea 05 e8 c9 d0 65 fc 90 <0f> 0b 90 e8 c0 d0 65 fc 5b c3 cc cc cc cc e8 55 8f d3 fc eb ce 0f
RSP: 0018:ffffc900033cfc90 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802d0da328 RCX: ffffffff8b8be29d
RDX: ffff8880776fca00 RSI: ffffffff85a2d617 RDI: ffff88802d0da3b0
RBP: ffff88802d0da000 R08: 0000000000000001 R09: fffff52000679f72
R10: ffffc900033cfb97 R11: ffffffff82763704 R12: ffff8880274ac000
R13: ffff88802d0da260 R14: 0000000000000002 R15: ffff88802d0da288
FS: 0000555556830500(0000) GS:ffff888124372000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feba2986400 CR3: 0000000033a76000 CR4: 00000000003526f0
Call Trace:
<TASK>
drm_file_free.part.0+0x7cf/0xc00 drivers/gpu/drm/drm_file.c:268
drm_file_free drivers/gpu/drm/drm_file.c:237 [inline]
drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:289
drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:437
__fput+0x3ff/0xb50 fs/file_table.c:510
task_work_run+0x150/0x240 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0x107/0x4f0 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x706/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feba299cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd43dfae88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffd43dfaf70 RCX: 00007feba299cdd9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000001dafd R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b31020000 R11: 0000000000000246 R12: 00007ffd43dfafb0
R13: 00007feba2c15fac R14: 000000000001db37 R15: 00007feba2c15fa0
</TASK>
Tested on:
commit: 1d5dcaa3 Merge tag 'probes-fixes-v7.1-rc3' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13baa3ce580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59da38148f3a3d24
dashboard link: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=11187dba580000
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dri?] WARNING in drm_prime_destroy_file_private (3)
2026-05-12 19:56 [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3) syzbot
2026-05-12 21:17 ` Hillf Danton
2026-05-13 3:13 ` Hillf Danton
@ 2026-05-13 3:58 ` Edward Adam Davis
2026-05-13 4:30 ` [syzbot] " syzbot
2026-05-13 4:30 ` [PATCH] drm: Replace old pointer to new idr Edward Adam Davis
3 siblings, 1 reply; 8+ messages in thread
From: Edward Adam Davis @ 2026-05-13 3:58 UTC (permalink / raw)
To: syzbot+d7c9eed171647e421013; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 51a887cc7fd7..8afab57fc055 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1067,17 +1067,12 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
spin_unlock(&file_priv->table_lock);
- if (ret < 0)
- goto out_unlock;
-
if (obj->dma_buf) {
ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,
handle);
if (ret < 0) {
spin_lock(&file_priv->table_lock);
idr_remove(&file_priv->object_idr, handle);
- idrobj = idr_replace(&file_priv->object_idr, obj, handle);
- WARN_ON(idrobj != NULL);
spin_unlock(&file_priv->table_lock);
goto out_unlock;
}
@@ -1089,7 +1084,9 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
spin_lock(&file_priv->table_lock);
idr_remove(&file_priv->object_idr, args->handle);
+ idrobj = idr_replace(&file_priv->object_idr, obj, handle);
spin_unlock(&file_priv->table_lock);
+ WARN_ON(idrobj != NULL);
out_unlock:
mutex_unlock(&file_priv->prime.lock);
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH] drm: Replace old pointer to new idr
2026-05-12 19:56 [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (3) syzbot
` (2 preceding siblings ...)
2026-05-13 3:58 ` Edward Adam Davis
@ 2026-05-13 4:30 ` Edward Adam Davis
3 siblings, 0 replies; 8+ messages in thread
From: Edward Adam Davis @ 2026-05-13 4:30 UTC (permalink / raw)
To: syzbot+d7c9eed171647e421013
Cc: airlied, dri-devel, linux-kernel, maarten.lankhorst, mripard,
simona, syzkaller-bugs, tzimmermann, David.Francis
Commit 5e28b7b94408 introduced a logical error by failing to replace the
newly generated IDR pointer to old id's pointer at the correct location
within the "change handle" logic; this resulted in the issue reported by
syzbot [1].
Specifically, the new IDR object pointer is intended to replace the original
id's pointer during the normal execution flow.
Additionally, an unnecessary conditional check for the ret exit path has
been removed.
[1]
!RB_EMPTY_ROOT(&prime_fpriv->dmabufs)
WARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/5833
Call Trace:
drm_file_free.part.0+0x7e6/0xcc0 drivers/gpu/drm/drm_file.c:269
drm_file_free drivers/gpu/drm/drm_file.c:237 [inline]
drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:290
drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:438
Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle")
Reported-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013
Tested-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
drivers/gpu/drm/drm_gem.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 51a887cc7fd7..8afab57fc055 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1067,17 +1067,12 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
spin_unlock(&file_priv->table_lock);
- if (ret < 0)
- goto out_unlock;
-
if (obj->dma_buf) {
ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,
handle);
if (ret < 0) {
spin_lock(&file_priv->table_lock);
idr_remove(&file_priv->object_idr, handle);
- idrobj = idr_replace(&file_priv->object_idr, obj, handle);
- WARN_ON(idrobj != NULL);
spin_unlock(&file_priv->table_lock);
goto out_unlock;
}
@@ -1089,7 +1084,9 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
spin_lock(&file_priv->table_lock);
idr_remove(&file_priv->object_idr, args->handle);
+ idrobj = idr_replace(&file_priv->object_idr, obj, handle);
spin_unlock(&file_priv->table_lock);
+ WARN_ON(idrobj != NULL);
out_unlock:
mutex_unlock(&file_priv->prime.lock);
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread