From 28fb889c7d41c76e5196b08e8ef109b3762f792b Mon Sep 17 00:00:00 2001 From: Xiyu Yang Date: Mon, 19 Jul 2021 13:58:51 +0800 Subject: [PATCH] drm/exynos: Convert from atomic_t to refcount_t on g2d_cmdlist_userptr->refcount refcount_t type and corresponding API can protect refcounters from accidental underflow and overflow and further use-after-free situations. Signed-off-by: Xiyu Yang Signed-off-by: Xin Tan Signed-off-by: Inki Dae --- drivers/gpu/drm/exynos/exynos_drm_g2d.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c index 0ed665501ac48..b00230626c6a0 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c +++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c @@ -4,6 +4,7 @@ * Authors: Joonyoung Shim */ +#include #include #include #include @@ -208,7 +209,7 @@ struct g2d_cmdlist_userptr { struct page **pages; unsigned int npages; struct sg_table *sgt; - atomic_t refcount; + refcount_t refcount; bool in_pool; bool out_of_list; }; @@ -386,9 +387,9 @@ static void g2d_userptr_put_dma_addr(struct g2d_data *g2d, if (force) goto out; - atomic_dec(&g2d_userptr->refcount); + refcount_dec(&g2d_userptr->refcount); - if (atomic_read(&g2d_userptr->refcount) > 0) + if (refcount_read(&g2d_userptr->refcount) > 0) return; if (g2d_userptr->in_pool) @@ -436,7 +437,7 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct g2d_data *g2d, * and different size. */ if (g2d_userptr->size == size) { - atomic_inc(&g2d_userptr->refcount); + refcount_inc(&g2d_userptr->refcount); *obj = g2d_userptr; return &g2d_userptr->dma_addr; @@ -461,7 +462,7 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct g2d_data *g2d, if (!g2d_userptr) return ERR_PTR(-ENOMEM); - atomic_set(&g2d_userptr->refcount, 1); + refcount_set(&g2d_userptr->refcount, 1); g2d_userptr->size = size; start = userptr & PAGE_MASK; -- 2.39.5