[Mesa-dev] [PATCH] gallium/winsys/kms: fix leaking gem handle.

[Tao Wu]

When handle was got from drmPrimeFDToHandle, it can't be destroyed with
destroy_dumb. Change to use drm_gem_close to release it. Otherwise video
ram could get leaked.

Signed-off-by: Tao Wu <lepton at google.com>
CC: <mesa-stable at lists.freedesktop.org>
---
 src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c b/src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c
index 22e1c936ac5..f7cd09b6aa9 100644
--- a/src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c
+++ b/src/gallium/winsys/sw/kms-dri/kms_dri_sw_winsys.c
@@ -27,6 +27,7 @@
  *
  **************************************************************************/
 
+#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <stddef.h>
@@ -172,7 +173,25 @@ kms_sw_displaytarget_destroy(struct sw_winsys *ws,
 
    memset(&destroy_req, 0, sizeof destroy_req);
    destroy_req.handle = kms_sw_dt->handle;
-   drmIoctl(kms_sw->fd, DRM_IOCTL_MODE_DESTROY_DUMB, &destroy_req);
+   int ret = drmIoctl(kms_sw->fd, DRM_IOCTL_MODE_DESTROY_DUMB, &destroy_req);
+   /* If handle was from drmPrimeFDToHandle, then kms_sw->fd is connected
+    * as render, we have to use drm_gem_close to release it.
+    */
+   if (ret < 0) {
+      if (errno == EACCES) {
+         /* Actually close_req has same memory layout with destroy_req.
+          * To be safe and clear, just copy it again.
+          */
+         struct drm_gem_close close_req;
+         close_req.handle = destroy_req.handle;
+         ret = drmIoctl(kms_sw->fd, DRM_IOCTL_GEM_CLOSE, &close_req);
+         if (ret < 0) {
+            DEBUG_PRINT("KMS-DEBUG: drm_gem_close still fail: %d", errno);
+         }
+      } else {
+         DEBUG_PRINT("KMS-DEBUG: destroy_dumb fail: %d", errno);
+      }
+   }
 
    list_del(&kms_sw_dt->link);
 
-- 
2.15.0.448.gf294e3d99a-goog