drm/etnaviv: fix reference leak when mmaping imported buffer

commit 963b2e8c428f79489ceeb058e8314554ec9cbe6f upstream.

drm_gem_prime_mmap() takes a reference on the GEM object, but before that
drm_gem_mmap_obj() already takes a reference, which will be leaked as only
one reference is dropped when the mapping is closed. Drop the extra
reference when dma_buf_mmap() succeeds.

Cc: stable@vger.kernel.org
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
index f24dd21c2363bc8231bd4445bb5d85ebe9440c4e..fe7817e4c0d1c36337ea755812196d0a25e6c3a0 100644 (file)
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -93,7 +93,15 @@ static void *etnaviv_gem_prime_vmap_impl(struct etnaviv_gem_object *etnaviv_obj)
 static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj,
                struct vm_area_struct *vma)
 {
-       return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0);
+       int ret;
+
+       ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0);
+       if (!ret) {
+               /* Drop the reference acquired by drm_gem_mmap_obj(). */
+               drm_gem_object_put(&etnaviv_obj->base);
+       }
+
+       return ret;
 }
 
 static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = {