Displaying 20 results from an estimated 66 matches for "drm_gem_object_release".
2020 Oct 06
1
[RFC] gem: fix "refcount_t: underflow; use-after-free"
...au_gem.c
@@ -198,7 +198,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain,
* to the caller, instead of a normal nouveau_bo ttm reference. */
ret = drm_gem_object_init(drm->dev, &nvbo->bo.base, size);
if (ret) {
- nouveau_bo_ref(NULL, &nvbo);
+ drm_gem_object_release(&nvbo->bo.base);
+ kfree(nvbo);
return ret;
}
--
2.26.2
2019 Sep 16
4
[PATCH 0/4] drm/nouveau: Miscellaneous fixes
From: Thierry Reding <treding at nvidia.com>
Hi Ben,
these are fixes for a couple of issues that I've been running into when
testing on various Tegra boards. The first two patches fix up issues in
the fix that I had sent out earlier to fix the regression introduced in
drm-misc-next. The first one is critical because it avoids a BUG_ON as
reported by Ilia, while the second is less
2019 Jun 20
0
[PATCH 3/6] drm/qxl: use embedded gem object
...->gem_base.dev->dev_private;
+ qdev = (struct qxl_device *)bo->tbo.base.dev->dev_private;
qxl_surface_evict(qdev, bo, false);
WARN_ON_ONCE(bo->map_count > 0);
mutex_lock(&qdev->gem.mutex);
list_del_init(&bo->list);
mutex_unlock(&qdev->gem.mutex);
- drm_gem_object_release(&bo->gem_base);
+ drm_gem_object_release(&bo->tbo.base);
kfree(bo);
}
@@ -95,7 +95,7 @@ int qxl_bo_create(struct qxl_device *qdev,
if (bo == NULL)
return -ENOMEM;
size = roundup(size, PAGE_SIZE);
- r = drm_gem_object_init(&qdev->ddev, &bo->gem_base, size);
+...
2019 Jun 21
0
[PATCH v2 03/18] drm/qxl: use embedded gem object
...->gem_base.dev->dev_private;
+ qdev = (struct qxl_device *)bo->tbo.base.dev->dev_private;
qxl_surface_evict(qdev, bo, false);
WARN_ON_ONCE(bo->map_count > 0);
mutex_lock(&qdev->gem.mutex);
list_del_init(&bo->list);
mutex_unlock(&qdev->gem.mutex);
- drm_gem_object_release(&bo->gem_base);
+ drm_gem_object_release(&bo->tbo.base);
kfree(bo);
}
@@ -95,7 +95,7 @@ int qxl_bo_create(struct qxl_device *qdev,
if (bo == NULL)
return -ENOMEM;
size = roundup(size, PAGE_SIZE);
- r = drm_gem_object_init(&qdev->ddev, &bo->gem_base, size);
+...
2019 Jun 28
0
[PATCH v3 03/18] drm/qxl: use embedded gem object
...->gem_base.dev->dev_private;
+ qdev = (struct qxl_device *)bo->tbo.base.dev->dev_private;
qxl_surface_evict(qdev, bo, false);
WARN_ON_ONCE(bo->map_count > 0);
mutex_lock(&qdev->gem.mutex);
list_del_init(&bo->list);
mutex_unlock(&qdev->gem.mutex);
- drm_gem_object_release(&bo->gem_base);
+ drm_gem_object_release(&bo->tbo.base);
kfree(bo);
}
@@ -95,7 +95,7 @@ int qxl_bo_create(struct qxl_device *qdev,
if (bo == NULL)
return -ENOMEM;
size = roundup(size, PAGE_SIZE);
- r = drm_gem_object_init(&qdev->ddev, &bo->gem_base, size);
+...
2019 Aug 02
0
[PATCH v4 03/17] drm/qxl: use embedded gem object
...->gem_base.dev->dev_private;
+ qdev = (struct qxl_device *)bo->tbo.base.dev->dev_private;
qxl_surface_evict(qdev, bo, false);
WARN_ON_ONCE(bo->map_count > 0);
mutex_lock(&qdev->gem.mutex);
list_del_init(&bo->list);
mutex_unlock(&qdev->gem.mutex);
- drm_gem_object_release(&bo->gem_base);
+ drm_gem_object_release(&bo->tbo.base);
kfree(bo);
}
@@ -95,7 +95,7 @@ int qxl_bo_create(struct qxl_device *qdev,
if (bo == NULL)
return -ENOMEM;
size = roundup(size, PAGE_SIZE);
- r = drm_gem_object_init(&qdev->ddev, &bo->gem_base, size);
+...
2019 Aug 05
0
[PATCH v5 03/18] drm/qxl: use embedded gem object
...->gem_base.dev->dev_private;
+ qdev = (struct qxl_device *)bo->tbo.base.dev->dev_private;
qxl_surface_evict(qdev, bo, false);
WARN_ON_ONCE(bo->map_count > 0);
mutex_lock(&qdev->gem.mutex);
list_del_init(&bo->list);
mutex_unlock(&qdev->gem.mutex);
- drm_gem_object_release(&bo->gem_base);
+ drm_gem_object_release(&bo->tbo.base);
kfree(bo);
}
@@ -95,7 +95,7 @@ int qxl_bo_create(struct qxl_device *qdev,
if (bo == NULL)
return -ENOMEM;
size = roundup(size, PAGE_SIZE);
- r = drm_gem_object_init(&qdev->ddev, &bo->gem_base, size);
+...
2019 Aug 05
0
[PATCH v6 03/17] drm/qxl: use embedded gem object
...->gem_base.dev->dev_private;
+ qdev = (struct qxl_device *)bo->tbo.base.dev->dev_private;
qxl_surface_evict(qdev, bo, false);
WARN_ON_ONCE(bo->map_count > 0);
mutex_lock(&qdev->gem.mutex);
list_del_init(&bo->list);
mutex_unlock(&qdev->gem.mutex);
- drm_gem_object_release(&bo->gem_base);
+ drm_gem_object_release(&bo->tbo.base);
kfree(bo);
}
@@ -95,7 +95,7 @@ int qxl_bo_create(struct qxl_device *qdev,
if (bo == NULL)
return -ENOMEM;
size = roundup(size, PAGE_SIZE);
- r = drm_gem_object_init(&qdev->ddev, &bo->gem_base, size);
+...
2020 Nov 03
0
[PATCH AUTOSEL 5.9 34/35] drm/nouveau/gem: fix "refcount_t: underflow; use-after-free"
...au_gem.c
@@ -198,7 +198,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain,
* to the caller, instead of a normal nouveau_bo ttm reference. */
ret = drm_gem_object_init(drm->dev, &nvbo->bo.base, size);
if (ret) {
- nouveau_bo_ref(NULL, &nvbo);
+ drm_gem_object_release(&nvbo->bo.base);
+ kfree(nvbo);
return ret;
}
--
2.27.0
2020 Nov 03
0
[PATCH AUTOSEL 5.8 28/29] drm/nouveau/gem: fix "refcount_t: underflow; use-after-free"
...au_gem.c
@@ -197,7 +197,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain,
* to the caller, instead of a normal nouveau_bo ttm reference. */
ret = drm_gem_object_init(drm->dev, &nvbo->bo.base, size);
if (ret) {
- nouveau_bo_ref(NULL, &nvbo);
+ drm_gem_object_release(&nvbo->bo.base);
+ kfree(nvbo);
return ret;
}
--
2.27.0
2020 Nov 03
0
[PATCH AUTOSEL 5.4 23/24] drm/nouveau/gem: fix "refcount_t: underflow; use-after-free"
...au_gem.c
@@ -197,7 +197,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain,
* to the caller, instead of a normal nouveau_bo ttm reference. */
ret = drm_gem_object_init(drm->dev, &nvbo->bo.base, size);
if (ret) {
- nouveau_bo_ref(NULL, &nvbo);
+ drm_gem_object_release(&nvbo->bo.base);
+ kfree(nvbo);
return ret;
}
--
2.27.0
2018 Dec 19
0
[PATCH 10/10] drm/virtio: ditch virtio_gpu_object_attach() calls
...u_ioctl.c
@@ -319,8 +319,6 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data,
return PTR_ERR(qobj);
obj = &qobj->gem_base;
- ret = virtio_gpu_object_attach(vgdev, qobj, NULL);
-
ret = drm_gem_handle_create(file_priv, obj, &handle);
if (ret) {
drm_gem_object_release(obj);
--
2.9.3
2018 Dec 19
0
[PATCH 08/10] drm/virtio: drop fencing in virtio_gpu_resource_create_ioctl
...- if (ret) {
- dma_fence_put(&fence->f);
- goto fail_backoff;
- }
- ttm_eu_fence_buffer_objects(&ticket, &validate_list, &fence->f);
+ ret = virtio_gpu_object_attach(vgdev, qobj, NULL);
}
ret = drm_gem_handle_create(file_priv, obj, &handle);
if (ret) {
-
drm_gem_object_release(obj);
- if (vgdev->has_virgl_3d) {
- virtio_gpu_unref_list(&validate_list);
- dma_fence_put(&fence->f);
- }
return ret;
}
drm_gem_object_put_unlocked(obj);
rc->res_handle = qobj->hw_res_handle; /* similiar to a VM address */
rc->bo_handle = handle;
-
- if (...
2019 Jul 02
2
[PATCH v6 11/18] drm/virtio: switch from ttm to gem shmem helpers
...object_params *params,
@@ -64,16 +56,16 @@ int virtio_gpu_gem_create(struct drm_file *file,
if (IS_ERR(obj))
return PTR_ERR(obj);
- ret = drm_gem_handle_create(file, &obj->gem_base, &handle);
+ ret = drm_gem_handle_create(file, &obj->base.base, &handle);
if (ret) {
- drm_gem_object_release(&obj->gem_base);
+ drm_gem_object_release(&obj->base.base);
return ret;
}
- *obj_p = &obj->gem_base;
+ *obj_p = &obj->base.base;
/* drop reference from allocate - handle holds it now */
- drm_gem_object_put_unlocked(&obj->gem_base);
+ drm_gem_object_pu...
2019 Jun 20
2
[PATCH v4 11/12] drm/virtio: switch from ttm to gem shmem helpers
...object_params *params,
@@ -64,16 +56,16 @@ int virtio_gpu_gem_create(struct drm_file *file,
if (IS_ERR(obj))
return PTR_ERR(obj);
- ret = drm_gem_handle_create(file, &obj->gem_base, &handle);
+ ret = drm_gem_handle_create(file, &obj->base.base, &handle);
if (ret) {
- drm_gem_object_release(&obj->gem_base);
+ drm_gem_object_release(&obj->base.base);
return ret;
}
- *obj_p = &obj->gem_base;
+ *obj_p = &obj->base.base;
/* drop reference from allocate - handle holds it now */
- drm_gem_object_put_unlocked(&obj->gem_base);
+ drm_gem_object_pu...
2019 Jun 20
2
[PATCH v4 11/12] drm/virtio: switch from ttm to gem shmem helpers
...object_params *params,
@@ -64,16 +56,16 @@ int virtio_gpu_gem_create(struct drm_file *file,
if (IS_ERR(obj))
return PTR_ERR(obj);
- ret = drm_gem_handle_create(file, &obj->gem_base, &handle);
+ ret = drm_gem_handle_create(file, &obj->base.base, &handle);
if (ret) {
- drm_gem_object_release(&obj->gem_base);
+ drm_gem_object_release(&obj->base.base);
return ret;
}
- *obj_p = &obj->gem_base;
+ *obj_p = &obj->base.base;
/* drop reference from allocate - handle holds it now */
- drm_gem_object_put_unlocked(&obj->gem_base);
+ drm_gem_object_pu...
2019 Apr 29
4
[PATCH v3 01/19] drm: Add |struct drm_gem_vram_object| and helpers
...fer-objects helpers
> + */
> +
> +static void drm_gem_vram_cleanup(struct drm_gem_vram_object *gbo)
> +{
> + /* We got here via ttm_bo_put(), which means that the
> + * TTM buffer object in 'bo' has already been cleaned
> + * up; only release the GEM object. */
> + drm_gem_object_release(&gbo->gem);
> +}
> +
> +static void drm_gem_vram_destroy(struct drm_gem_vram_object *gbo)
> +{
> + drm_gem_vram_cleanup(gbo);
> + kfree(gbo);
> +}
> +
> +static void ttm_buffer_object_destroy(struct ttm_buffer_object *bo)
> +{
> + struct drm_gem_vram_object *...
2019 Apr 29
4
[PATCH v3 01/19] drm: Add |struct drm_gem_vram_object| and helpers
...fer-objects helpers
> + */
> +
> +static void drm_gem_vram_cleanup(struct drm_gem_vram_object *gbo)
> +{
> + /* We got here via ttm_bo_put(), which means that the
> + * TTM buffer object in 'bo' has already been cleaned
> + * up; only release the GEM object. */
> + drm_gem_object_release(&gbo->gem);
> +}
> +
> +static void drm_gem_vram_destroy(struct drm_gem_vram_object *gbo)
> +{
> + drm_gem_vram_cleanup(gbo);
> + kfree(gbo);
> +}
> +
> +static void ttm_buffer_object_destroy(struct ttm_buffer_object *bo)
> +{
> + struct drm_gem_vram_object *...
2019 Aug 02
0
[PATCH v7 14/18] drm/virtio: switch from ttm to gem shmem helpers
...object_params *params,
@@ -66,16 +58,16 @@ int virtio_gpu_gem_create(struct drm_file *file,
if (IS_ERR(obj))
return PTR_ERR(obj);
- ret = drm_gem_handle_create(file, &obj->gem_base, &handle);
+ ret = drm_gem_handle_create(file, &obj->base.base, &handle);
if (ret) {
- drm_gem_object_release(&obj->gem_base);
+ drm_gem_object_release(&obj->base.base);
return ret;
}
- *obj_p = &obj->gem_base;
+ *obj_p = &obj->base.base;
/* drop reference from allocate - handle holds it now */
- drm_gem_object_put_unlocked(&obj->gem_base);
+ drm_gem_object_pu...
2019 Jun 18
0
[PATCH v2 10/12] drm/virtio: switch from ttm to gem shmem helpers
...object_params *params,
@@ -64,16 +56,16 @@ int virtio_gpu_gem_create(struct drm_file *file,
if (IS_ERR(obj))
return PTR_ERR(obj);
- ret = drm_gem_handle_create(file, &obj->gem_base, &handle);
+ ret = drm_gem_handle_create(file, &obj->base.base, &handle);
if (ret) {
- drm_gem_object_release(&obj->gem_base);
+ drm_gem_object_release(&obj->base.base);
return ret;
}
- *obj_p = &obj->gem_base;
+ *obj_p = &obj->base.base;
/* drop reference from allocate - handle holds it now */
- drm_gem_object_put_unlocked(&obj->gem_base);
+ drm_gem_object_pu...