Patch "drm/omap: Fix locking in omap_gem_new_dmabuf()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/omap: Fix locking in omap_gem_new_dmabuf()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 330047ce36067b351de405490a3f6dca7d5f6787
Author: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
Date:   Tue Aug 6 16:50:29 2024 +0300

    drm/omap: Fix locking in omap_gem_new_dmabuf()
    
    [ Upstream commit e6a1c4037227539373c8cf484ace83833e2ad6a2 ]
    
    omap_gem_new_dmabuf() creates the new gem object, and then takes and
    holds the omap_obj->lock for the rest of the function. This has two
    issues:
    
    - omap_gem_free_object(), which is called in the error paths, also takes
      the same lock, leading to deadlock
    - Even if the above wouldn't happen, in the error cases
      omap_gem_new_dmabuf() still unlocks omap_obj->lock, even after the
      omap_obj has already been freed.
    
    Furthermore, I don't think there's any reason to take the lock at all,
    as the object was just created and not yet shared with anyone else.
    
    To fix all this, drop taking the lock.
    
    Fixes: 3cbd0c587b12 ("drm/omap: gem: Replace struct_mutex usage with omap_obj private lock")
    Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Closes: https://lore.kernel.org/all/511b99d7-aade-4f92-bd3e-63163a13d617@stanley.mountain/
    Reviewed-by: Sebastian Reichel <sebastian.reichel@xxxxxxxxxxxxx>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240806-omapdrm-misc-fixes-v1-3-15d31aea0831@xxxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
index c48fa531ca321..68117eed702be 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -1395,8 +1395,6 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size,
 
 	omap_obj = to_omap_bo(obj);
 
-	mutex_lock(&omap_obj->lock);
-
 	omap_obj->sgt = sgt;
 
 	if (sgt->orig_nents == 1) {
@@ -1411,21 +1409,17 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size,
 		pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
 		if (!pages) {
 			omap_gem_free_object(obj);
-			obj = ERR_PTR(-ENOMEM);
-			goto done;
+			return ERR_PTR(-ENOMEM);
 		}
 
 		omap_obj->pages = pages;
 		ret = drm_prime_sg_to_page_array(sgt, pages, npages);
 		if (ret) {
 			omap_gem_free_object(obj);
-			obj = ERR_PTR(-ENOMEM);
-			goto done;
+			return ERR_PTR(-ENOMEM);
 		}
 	}
 
-done:
-	mutex_unlock(&omap_obj->lock);
 	return obj;
 }