Introduce drm_gem_object_set_resv() to safely assign reservation objects to GEM objects with proper reference counting. This helper replaces all direct assignments to drm_gem_object.resv throughout the DRM subsystem.
The function: - Acquires a reference to the new resv via dma_resv_get() - Assigns it to obj->resv - Releases the old resv reference via dma_resv_put() This ensures proper reference counting when sharing reservation objects between GEM objects or when importing dma-bufs, preventing reference leaks and use-after-free bugs. Update all drivers to use the new helper: - drm_prime: dma-buf import path - drm_gem_shmem_helper: shmem prime import - i915: dmabuf import - msm: MSM_BO_NO_SHARE case - panthor: exclusive_vm case - virtio: dma-buf import - xe: dummy object creation - ttm: external resv assignment - ttm/tests: test cases Signed-off-by: Christian König <[email protected]> Assisted-by: Claude:Sonnet 4 --- drivers/gpu/drm/drm_gem.c | 31 ++++++++++++++++++- drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- drivers/gpu/drm/drm_prime.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 2 +- drivers/gpu/drm/panthor/panthor_gem.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c | 2 +- drivers/gpu/drm/ttm/ttm_bo.c | 7 ++--- drivers/gpu/drm/virtio/virtgpu_prime.c | 2 +- drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- include/drm/drm_gem.h | 2 ++ 12 files changed, 43 insertions(+), 15 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 48176a11d5520..bbcbd25f014f0 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -230,7 +230,7 @@ void drm_gem_private_object_init(struct drm_device *dev, mutex_init(&obj->gpuva.lock); dma_resv_init(&obj->_resv); if (!obj->resv) - obj->resv = &obj->_resv; + obj->resv = dma_resv_get(&obj->_resv); drm_gem_gpuva_init(obj); @@ -249,11 +249,40 @@ void drm_gem_private_object_fini(struct drm_gem_object *obj) { WARN_ON(obj->dma_buf); + dma_resv_put(obj->resv); dma_resv_put(&obj->_resv); mutex_destroy(&obj->gpuva.lock); } EXPORT_SYMBOL(drm_gem_private_object_fini); +/** + * drm_gem_object_set_resv - Set the reservation object for a GEM object + * @obj: GEM object + * @resv: reservation object to assign + * + * This function safely assigns a new reservation object to a GEM object. + * It releases the old reservation object reference (if any) and acquires + * a reference to the new one. + * + * This should be used when changing the reservation object of an already + * initialized GEM object, for example when importing a dma-buf or sharing + * a reservation object with another object. + * + * Returns: + * The new reservation object pointer for convenience. + */ +struct dma_resv *drm_gem_object_set_resv(struct drm_gem_object *obj, + struct dma_resv *resv) +{ + struct dma_resv *old_resv = obj->resv; + + obj->resv = dma_resv_get(resv); + dma_resv_put(old_resv); + + return obj->resv; +} +EXPORT_SYMBOL(drm_gem_object_set_resv); + static void drm_gem_object_handle_get(struct drm_gem_object *obj) { struct drm_device *dev = obj->dev; diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 22ec52e2ffb87..76a8d7f252e00 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -977,7 +977,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, drm_dbg_prime(dev, "size = %zu\n", size); shmem->base.import_attach = attach; - shmem->base.resv = dma_buf->resv; + drm_gem_object_set_resv(&shmem->base, dma_buf->resv); return &shmem->base; diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 9b44c78cd77fc..6cfeca347faff 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -1006,7 +1006,7 @@ struct drm_gem_object *drm_gem_prime_import_dev(struct drm_device *dev, } obj->import_attach = attach; - obj->resv = dma_buf->resv; + drm_gem_object_set_resv(obj, dma_buf->resv); return obj; diff --git a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c index b43d34c7d6419..c824606497d2e 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c @@ -320,7 +320,7 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev, i915_gem_object_init(obj, &i915_gem_object_dmabuf_ops, &lock_class, I915_BO_ALLOC_USER); obj->base.import_attach = attach; - obj->base.resv = dma_buf->resv; + drm_gem_object_set_resv(&obj->base, dma_buf->resv); /* We use GTT as shorthand for a coherent domain, one that is * neither in the GPU cache nor in the CPU cache, where all diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c index efd3d3c9a4490..81ebb1e1094c3 100644 --- a/drivers/gpu/drm/msm/msm_gem.c +++ b/drivers/gpu/drm/msm/msm_gem.c @@ -1151,7 +1151,7 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file, drm_gem_object_get(r_obj); - obj->resv = r_obj->resv; + drm_gem_object_set_resv(obj, r_obj->resv); } ret = drm_gem_handle_create(file, obj, handle); diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c index 9855df7381947..2de24f1b60184 100644 --- a/drivers/gpu/drm/panthor/panthor_gem.c +++ b/drivers/gpu/drm/panthor/panthor_gem.c @@ -1024,7 +1024,7 @@ panthor_gem_create(struct drm_device *dev, size_t size, uint32_t flags, if (exclusive_vm) { bo->exclusive_vm_root_gem = panthor_vm_root_gem(exclusive_vm); drm_gem_object_get(bo->exclusive_vm_root_gem); - bo->base.resv = bo->exclusive_vm_root_gem->resv; + drm_gem_object_set_resv(&bo->base, bo->exclusive_vm_root_gem->resv); } panthor_gem_debugfs_set_usage_flags(bo, usage_flags); diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c index 49b0b48c6c2ac..3aff1c427cd1f 100644 --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c @@ -461,7 +461,7 @@ static void ttm_bo_fini_shared_resv(struct kunit *test) bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); bo->type = ttm_bo_type_device; - bo->base.resv = external_resv; + drm_gem_object_set_resv(&bo->base, external_resv); ttm_bo_fini(bo); } diff --git a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c index 5cfe8f3f80d75..1146cc9ae5224 100644 --- a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c +++ b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c @@ -181,7 +181,7 @@ struct ttm_buffer_object *ttm_bo_kunit_init(struct kunit *test, bo->base = gem_obj; if (obj) - bo->base.resv = obj; + drm_gem_object_set_resv(&bo->base, obj); err = drm_gem_object_init(devs->drm, &bo->base, size); KUNIT_ASSERT_EQ(test, err, 0); diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 3980f376e3ba4..8cf266da2bc61 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -209,7 +209,7 @@ static int ttm_bo_individualize_resv(struct ttm_buffer_object *bo) * the resv object while holding the lru_lock. */ spin_lock(&bo->bdev->lru_lock); - bo->base.resv = &bo->base._resv; + drm_gem_object_set_resv(&bo->base, &bo->base._resv); spin_unlock(&bo->bdev->lru_lock); } @@ -942,10 +942,7 @@ int ttm_bo_init_reserved(struct ttm_device *bdev, struct ttm_buffer_object *bo, bo->pin_count = 0; bo->sg = sg; bo->bulk_move = NULL; - if (resv) - bo->base.resv = resv; - else - bo->base.resv = &bo->base._resv; + drm_gem_object_set_resv(&bo->base, resv ?: &bo->base._resv); atomic_inc(&ttm_glob.bo_count); /* diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c index 216c77cd0d21b..79964b4362439 100644 --- a/drivers/gpu/drm/virtio/virtgpu_prime.c +++ b/drivers/gpu/drm/virtio/virtgpu_prime.c @@ -361,7 +361,7 @@ struct drm_gem_object *virtgpu_gem_prime_import(struct drm_device *dev, INIT_LIST_HEAD(&bo->restore_node); obj = &bo->base.base; - obj->resv = buf->resv; + drm_gem_object_set_resv(obj, buf->resv); obj->funcs = &virtgpu_gem_dma_buf_funcs; drm_gem_private_object_init(dev, obj, buf->size); diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c index 8a920e58245cd..33bebf85ac622 100644 --- a/drivers/gpu/drm/xe/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/xe_dma_buf.c @@ -293,7 +293,7 @@ xe_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf) if (!dummy_obj) return ERR_PTR(-ENOMEM); - dummy_obj->resv = resv; + drm_gem_object_set_resv(dummy_obj, resv); xe_validation_guard(&ctx, &xe->val, &exec, (struct xe_val_flags) {}, ret) { ret = drm_exec_lock_obj(&exec, dummy_obj); drm_exec_retry_on_contention(&exec); diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 885244e375d32..09f5ec28218a0 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -529,6 +529,8 @@ int drm_gem_object_init(struct drm_device *dev, void drm_gem_private_object_init(struct drm_device *dev, struct drm_gem_object *obj, size_t size); void drm_gem_private_object_fini(struct drm_gem_object *obj); +struct dma_resv *drm_gem_object_set_resv(struct drm_gem_object *obj, + struct dma_resv *resv); void drm_gem_vm_open(struct vm_area_struct *vma); void drm_gem_vm_close(struct vm_area_struct *vma); int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size, -- 2.43.0
