[PATCH v2 10/10] drm: omapdrm: Take GEM obj and DRM dev references when exporting dmabuf

[Laurent Pinchart]

To ensure that neither the GEM object nor the DRM device goes away while
a GEM object exported through dma-buf is still accessible, take a
reference to both the GEM object and the DRM device at export time. The
dma-buf release handler already releases the GEM object (which resulted
in a refcount underflow) and now also releases the DRM device.

Fixes: 6ad11bc3a0b8 ("staging: drm/omap: dmabuf/prime support")
Signed-off-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
---
 drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
index 79dfded9613c..88ad723b3044 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
@@ -75,10 +75,11 @@ static void omap_gem_unmap_dma_buf(struct dma_buf_attachment *attachment,
 static void omap_gem_dmabuf_release(struct dma_buf *buffer)
 {
 	struct drm_gem_object *obj = buffer->priv;
-	/* release reference that was taken when dmabuf was exported
-	 * in omap_gem_prime_set()..
-	 */
+	struct drm_device *dev = obj->dev;
+
+	/* Release references taken by omap_gem_prime_export(). */
 	drm_gem_object_unreference_unlocked(obj);
+	drm_dev_ref(dev);
 }
 
 
@@ -184,13 +185,21 @@ struct dma_buf *omap_gem_prime_export(struct drm_device *dev,
 		struct drm_gem_object *obj, int flags)
 {
 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct dma_buf *dma_buf;
 
 	exp_info.ops = &omap_dmabuf_ops;
 	exp_info.size = obj->size;
 	exp_info.flags = flags;
 	exp_info.priv = obj;
 
-	return dma_buf_export(&exp_info);
+	dma_buf = dma_buf_export(&exp_info);
+	if (IS_ERR(dma_buf))
+		return dma_buf;
+
+	drm_dev_ref(dev);
+	drm_gem_object_reference(obj);
+
+	return dma_buf;
 }
 
 /* -----------------------------------------------------------------------------
-- 
Regards,

Laurent Pinchart