From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEB9434BA42 for ; Fri, 10 Jul 2026 19:07:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783710481; cv=none; b=BoGetGCw6+SmKzQEdHEdkAKOUIHmWch+EWTn5i8z9tZx0909GBQY9Wv5bjCptLzlWt1mRRx9husKDwKz2GeasVyMDdJ5QQMKMfrY8EtlwevDfcAmLAcIGWPl8Jm0fsRvGYyUmnF2ms9uyb/FTm8F/hVuB3aqnX41HgnW0F+7FpU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783710481; c=relaxed/simple; bh=9Lt4uE+NvPYdwOJPvhwKA6cQrtYjk+AbPBolA7CN8F8=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=dr0Cnlq3TlBJlQUeaj+uFUR4i9q+1SPfaZgKLFAuBd11DITV9tbAWa+GMeVcf1BxW3GfIqvWCQou+3IiQw5xoBQs0XUdo+ATWFdh2eXbrDl/hyHchZ4AQFyXGsbsa9mXglSfWKg6chmtdIsvV4GJHTq3yyTP8btC61O/aS+ahhk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MTS/BWu+; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MTS/BWu+" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-493b77b150aso11105085e9.2 for ; Fri, 10 Jul 2026 12:07:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783710478; x=1784315278; darn=vger.kernel.org; h=content-transfer-encoding:reply-to:content-type:mime-version :references:in-reply-to:message-id:date:subject:to:from:from:to:cc :subject:date:message-id:reply-to:content-type; bh=uHZls/c3u18t+teDeH8BRqkPKNSdAEF6EYbxY9YBzrs=; b=MTS/BWu+GSsyvQCNUIApMNLxMNdwEfrDcmk1IoRnkTvh8W4AqxaWSmagSDWxFm/aYo kbHucXQQ5kUIzDXL49zE+Y4Yn6oy7DWhLeC3ba21H0xxdqAPBGfoE8UpAdYmracJemNP Z/mGQ/LJykKoLlWTvLrfP0PDkb4QhiHOb+Y6uZ67DXfpM+90uSlBF2KfOV3KtvF/MQbh 2yVzxXW52FWkfGtU4j/T2iYOhW6GI97KJ2uoU0rSBzdaBwv2ymud997i51xdvjVccRKL xoHDbr3eSal5O1+Q95ZNzl1KBgFxm9TBXCP/ZKhVtE0+vQ+c3UZiHHcakoNV1VVUSf2H zvwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783710478; x=1784315278; h=content-transfer-encoding:reply-to:content-type:mime-version :references:in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=uHZls/c3u18t+teDeH8BRqkPKNSdAEF6EYbxY9YBzrs=; b=sXtF1Mn8gwjUwh+7GyyFihXTvDQfVy7xtEOCa5yQmXJDKeyTe2j3FuFVpt1Rb5J0U3 +FongayyOmjrVa5hPmlv/ZATMQa+e8RCX9nOYscEHXCdvTXRBrXp4sTajbjAb/gBkNUD mOPVGS+5ZS31ayEPH4J1Oa6sm9IW3ktIH2eQtm19LWHLqy0SYWnP8FDDnyIOT3aI/Pm3 jD/51ZAQvkQspV3vVjdaUkddbkOm+mxFg8Y0lq2UY3Vc9hgkY3GvPH4ZzU5Ca5pTUQes 55nrD5SFC2TT2fE1KfovzmPwNUqeA+ly+ysHJyuJRV99N2YJbZAeevFDOlAvI+H0d19j aXFw== X-Forwarded-Encrypted: i=1; AHgh+RpZMo28rdmL5mfgAkqLiW0nTlR583RVB0S77D1JAWBCTpORRQu+hH9uHma9yWhLJ8ur9hHAobchg29nUmM=@vger.kernel.org X-Gm-Message-State: AOJu0Yzm5XivOyH82IU4tBur5QN+iop2Wckp2xOb9xcaXXsbv9Wfw/8c X6QH8oQ6HQYkgIlV5gNum4VBZ42c/fkD7BcY8lcZdw4iV4tD2YoI9l7Y X-Gm-Gg: AfdE7cloE+o+mi6wdGZ9aO+ypyYGgatlycV/jsmSdJdEBcGGESxJ8PlaFMsA4RBmPFg Vy/gVx/tAquEPxSKT2dgZK1QgoBk+t6OzF7OQjqZ8FkcCWJJDGv0O44KOqeYhAd1gcBKYUCo31r Aibi5vasT17W52FE4pTslcaogQv6YqSGO1CUz47QQ1XyEVOV4xeDl0dT1Dijz4ev+UL6uFtey1v gE4C+Lb7NtNWwJfh5zrqAXiAs2eHExiKDPzM9pnd2/29L/KfKhTQo3mnJaH5W9x0GCBuyT9Y5If gPKGI4XLPNnausGhhOwPsqxi0y8qhugXiXH64RISbKfdylOx8oD68Yy3+IPAtkOUAGON4NgQ1xR Gn75AT6w19Wuz+tLVlLSpkxYZxM5KYB0bNHIhrZrqUwlCLS+Kaj3a8Y7BGJxS0ERY/f+0XjGtMO Gq1uecn55/LnqheFI7KBKoa/lM5g== X-Received: by 2002:a05:600c:4f8a:b0:493:f7c8:eae2 with SMTP id 5b1f17b1804b1-493f87e6e9cmr1274015e9.15.1783710478048; Fri, 10 Jul 2026 12:07:58 -0700 (PDT) Received: from able.fritz.box ([2a00:e180:154f:ec00:aa08:de24:db33:4496]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493f567eadfsm55000755e9.6.2026.07.10.12.07.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 12:07:57 -0700 (PDT) From: "=?UTF-8?q?Christian=20K=C3=B6nig?=" X-Google-Original-From: =?UTF-8?q?Christian=20K=C3=B6nig?= To: thomas.hellstrom@linux.intel.com, dakr@kernel.org, ecourtney@nvidia.com, simona@ffwll.ch, matthew.brost@intel.com, nat@pixelcluster.dev, airlied@gmail.com, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, intel-gfx@lists.freedesktop.org, intel-xe@lists.freedesktop.org, amd-gfx@lists.freedesktop.org Subject: [PATCH 03/12] drm/gem: Add helper for drm_gem_object resv assignment Date: Fri, 10 Jul 2026 20:52:43 +0200 Message-ID: <20260710190752.2355-4-christian.koenig@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260710190752.2355-1-christian.koenig@amd.com> References: <20260710190752.2355-1-christian.koenig@amd.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Reply-To: christian.koenig@amd.com Content-Transfer-Encoding: 8bit Introduce drm_gem_object_set_resv() to safely assign reservation objects to GEM objects with proper reference counting. This helper replaces all direct assignments to drm_gem_object.resv throughout the DRM subsystem. The function: - Acquires a reference to the new resv via dma_resv_get() - Assigns it to obj->resv - Releases the old resv reference via dma_resv_put() This ensures proper reference counting when sharing reservation objects between GEM objects or when importing dma-bufs, preventing reference leaks and use-after-free bugs. Update all drivers to use the new helper: - drm_prime: dma-buf import path - drm_gem_shmem_helper: shmem prime import - i915: dmabuf import - msm: MSM_BO_NO_SHARE case - panthor: exclusive_vm case - virtio: dma-buf import - xe: dummy object creation - ttm: external resv assignment - ttm/tests: test cases Signed-off-by: Christian König Assisted-by: Claude:Sonnet 4 --- drivers/gpu/drm/drm_gem.c | 31 ++++++++++++++++++- drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- drivers/gpu/drm/drm_prime.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 2 +- drivers/gpu/drm/panthor/panthor_gem.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c | 2 +- drivers/gpu/drm/ttm/ttm_bo.c | 7 ++--- drivers/gpu/drm/virtio/virtgpu_prime.c | 2 +- drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- include/drm/drm_gem.h | 2 ++ 12 files changed, 43 insertions(+), 15 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 48176a11d5520..bbcbd25f014f0 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -230,7 +230,7 @@ void drm_gem_private_object_init(struct drm_device *dev, mutex_init(&obj->gpuva.lock); dma_resv_init(&obj->_resv); if (!obj->resv) - obj->resv = &obj->_resv; + obj->resv = dma_resv_get(&obj->_resv); drm_gem_gpuva_init(obj); @@ -249,11 +249,40 @@ void drm_gem_private_object_fini(struct drm_gem_object *obj) { WARN_ON(obj->dma_buf); + dma_resv_put(obj->resv); dma_resv_put(&obj->_resv); mutex_destroy(&obj->gpuva.lock); } EXPORT_SYMBOL(drm_gem_private_object_fini); +/** + * drm_gem_object_set_resv - Set the reservation object for a GEM object + * @obj: GEM object + * @resv: reservation object to assign + * + * This function safely assigns a new reservation object to a GEM object. + * It releases the old reservation object reference (if any) and acquires + * a reference to the new one. + * + * This should be used when changing the reservation object of an already + * initialized GEM object, for example when importing a dma-buf or sharing + * a reservation object with another object. + * + * Returns: + * The new reservation object pointer for convenience. + */ +struct dma_resv *drm_gem_object_set_resv(struct drm_gem_object *obj, + struct dma_resv *resv) +{ + struct dma_resv *old_resv = obj->resv; + + obj->resv = dma_resv_get(resv); + dma_resv_put(old_resv); + + return obj->resv; +} +EXPORT_SYMBOL(drm_gem_object_set_resv); + static void drm_gem_object_handle_get(struct drm_gem_object *obj) { struct drm_device *dev = obj->dev; diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 22ec52e2ffb87..76a8d7f252e00 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -977,7 +977,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, drm_dbg_prime(dev, "size = %zu\n", size); shmem->base.import_attach = attach; - shmem->base.resv = dma_buf->resv; + drm_gem_object_set_resv(&shmem->base, dma_buf->resv); return &shmem->base; diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 9b44c78cd77fc..6cfeca347faff 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -1006,7 +1006,7 @@ struct drm_gem_object *drm_gem_prime_import_dev(struct drm_device *dev, } obj->import_attach = attach; - obj->resv = dma_buf->resv; + drm_gem_object_set_resv(obj, dma_buf->resv); return obj; diff --git a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c index b43d34c7d6419..c824606497d2e 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c @@ -320,7 +320,7 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev, i915_gem_object_init(obj, &i915_gem_object_dmabuf_ops, &lock_class, I915_BO_ALLOC_USER); obj->base.import_attach = attach; - obj->base.resv = dma_buf->resv; + drm_gem_object_set_resv(&obj->base, dma_buf->resv); /* We use GTT as shorthand for a coherent domain, one that is * neither in the GPU cache nor in the CPU cache, where all diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c index efd3d3c9a4490..81ebb1e1094c3 100644 --- a/drivers/gpu/drm/msm/msm_gem.c +++ b/drivers/gpu/drm/msm/msm_gem.c @@ -1151,7 +1151,7 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file, drm_gem_object_get(r_obj); - obj->resv = r_obj->resv; + drm_gem_object_set_resv(obj, r_obj->resv); } ret = drm_gem_handle_create(file, obj, handle); diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c index 9855df7381947..2de24f1b60184 100644 --- a/drivers/gpu/drm/panthor/panthor_gem.c +++ b/drivers/gpu/drm/panthor/panthor_gem.c @@ -1024,7 +1024,7 @@ panthor_gem_create(struct drm_device *dev, size_t size, uint32_t flags, if (exclusive_vm) { bo->exclusive_vm_root_gem = panthor_vm_root_gem(exclusive_vm); drm_gem_object_get(bo->exclusive_vm_root_gem); - bo->base.resv = bo->exclusive_vm_root_gem->resv; + drm_gem_object_set_resv(&bo->base, bo->exclusive_vm_root_gem->resv); } panthor_gem_debugfs_set_usage_flags(bo, usage_flags); diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c index 49b0b48c6c2ac..3aff1c427cd1f 100644 --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c @@ -461,7 +461,7 @@ static void ttm_bo_fini_shared_resv(struct kunit *test) bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); bo->type = ttm_bo_type_device; - bo->base.resv = external_resv; + drm_gem_object_set_resv(&bo->base, external_resv); ttm_bo_fini(bo); } diff --git a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c index 5cfe8f3f80d75..1146cc9ae5224 100644 --- a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c +++ b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c @@ -181,7 +181,7 @@ struct ttm_buffer_object *ttm_bo_kunit_init(struct kunit *test, bo->base = gem_obj; if (obj) - bo->base.resv = obj; + drm_gem_object_set_resv(&bo->base, obj); err = drm_gem_object_init(devs->drm, &bo->base, size); KUNIT_ASSERT_EQ(test, err, 0); diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 3980f376e3ba4..8cf266da2bc61 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -209,7 +209,7 @@ static int ttm_bo_individualize_resv(struct ttm_buffer_object *bo) * the resv object while holding the lru_lock. */ spin_lock(&bo->bdev->lru_lock); - bo->base.resv = &bo->base._resv; + drm_gem_object_set_resv(&bo->base, &bo->base._resv); spin_unlock(&bo->bdev->lru_lock); } @@ -942,10 +942,7 @@ int ttm_bo_init_reserved(struct ttm_device *bdev, struct ttm_buffer_object *bo, bo->pin_count = 0; bo->sg = sg; bo->bulk_move = NULL; - if (resv) - bo->base.resv = resv; - else - bo->base.resv = &bo->base._resv; + drm_gem_object_set_resv(&bo->base, resv ?: &bo->base._resv); atomic_inc(&ttm_glob.bo_count); /* diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c index 216c77cd0d21b..79964b4362439 100644 --- a/drivers/gpu/drm/virtio/virtgpu_prime.c +++ b/drivers/gpu/drm/virtio/virtgpu_prime.c @@ -361,7 +361,7 @@ struct drm_gem_object *virtgpu_gem_prime_import(struct drm_device *dev, INIT_LIST_HEAD(&bo->restore_node); obj = &bo->base.base; - obj->resv = buf->resv; + drm_gem_object_set_resv(obj, buf->resv); obj->funcs = &virtgpu_gem_dma_buf_funcs; drm_gem_private_object_init(dev, obj, buf->size); diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c index 8a920e58245cd..33bebf85ac622 100644 --- a/drivers/gpu/drm/xe/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/xe_dma_buf.c @@ -293,7 +293,7 @@ xe_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf) if (!dummy_obj) return ERR_PTR(-ENOMEM); - dummy_obj->resv = resv; + drm_gem_object_set_resv(dummy_obj, resv); xe_validation_guard(&ctx, &xe->val, &exec, (struct xe_val_flags) {}, ret) { ret = drm_exec_lock_obj(&exec, dummy_obj); drm_exec_retry_on_contention(&exec); diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 885244e375d32..09f5ec28218a0 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -529,6 +529,8 @@ int drm_gem_object_init(struct drm_device *dev, void drm_gem_private_object_init(struct drm_device *dev, struct drm_gem_object *obj, size_t size); void drm_gem_private_object_fini(struct drm_gem_object *obj); +struct dma_resv *drm_gem_object_set_resv(struct drm_gem_object *obj, + struct dma_resv *resv); void drm_gem_vm_open(struct vm_area_struct *vma); void drm_gem_vm_close(struct vm_area_struct *vma); int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size, -- 2.43.0