drm/prime: add exported buffers to current fprivs imported buffer list (v2)

If userspace attempts to import a buffer it exported on the same device,
we need to return the same GEM handle for it, not a new handle pointing
at the same GEM object.

v2: move removals into a single fn, no need to set to NULL. (Chris Wilson)

Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 72ba0757feaa51801703308e03337779caa809aa..d58e69da1fb5b4aa1bf62cf9d27c5486d56fa567 100644 (file)
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -201,6 +201,19 @@ free:
 }
 EXPORT_SYMBOL(drm_gem_object_alloc);
 
+static void
+drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp)
+{
+       if (obj->import_attach) {
+               drm_prime_remove_imported_buf_handle(&filp->prime,
+                               obj->import_attach->dmabuf);
+       }
+       if (obj->export_dma_buf) {
+               drm_prime_remove_imported_buf_handle(&filp->prime,
+                               obj->export_dma_buf);
+       }
+}
+
 /**
  * Removes the mapping from handle to filp for this object.
  */
@@ -233,9 +246,7 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle)
        idr_remove(&filp->object_idr, handle);
        spin_unlock(&filp->table_lock);
 
-       if (obj->import_attach)
-               drm_prime_remove_imported_buf_handle(&filp->prime,
-                               obj->import_attach->dmabuf);
+       drm_gem_remove_prime_handles(obj, filp);
 
        if (dev->driver->gem_close_object)
                dev->driver->gem_close_object(obj, filp);
@@ -530,9 +541,7 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
        struct drm_gem_object *obj = ptr;
        struct drm_device *dev = obj->dev;
 
-       if (obj->import_attach)
-               drm_prime_remove_imported_buf_handle(&file_priv->prime,
-                               obj->import_attach->dmabuf);
+       drm_gem_remove_prime_handles(obj, file_priv);
 
        if (dev->driver->gem_close_object)
                dev->driver->gem_close_object(obj, file_priv);

diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index 20dbf2c45385d350f62e91a26e90bebfc6918a14..f546ff98a1147d01647cf14a657f9f5b17fc1507 100644 (file)
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -68,6 +68,7 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev,
 {
        struct drm_gem_object *obj;
        void *buf;
+       int ret;
 
        obj = drm_gem_object_lookup(dev, file_priv, handle);
        if (!obj)
@@ -100,6 +101,17 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev,
                obj->export_dma_buf = buf;
                *prime_fd = dma_buf_fd(buf, flags);
        }
+       /* if we've exported this buffer the cheat and add it to the import list
+        * so we get the correct handle back
+        */
+       ret = drm_prime_add_imported_buf_handle(&file_priv->prime,
+                       obj->export_dma_buf, handle);
+       if (ret) {
+               drm_gem_object_unreference_unlocked(obj);
+               mutex_unlock(&file_priv->prime.lock);
+               return ret;
+       }
+
        mutex_unlock(&file_priv->prime.lock);
        return 0;
 }