Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 10 Sep 2018 10:37:31 +0200
From:   Gerd Hoffmann <kraxel@redhat.com>
To:     Gert Wollny <gert.wollny@collabora.com>
Cc:     linux-kernel@vger.kernel.org, David Airlie <airlied@linux.ie>,
        Tomeu Vizoso <tomeu.vizoso@collabora.com>,
        Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
        Daniel Vetter <daniel@ffwll.ch>
Subject: Re: [PATCH v7] Add udmabuf misc device
Message-ID: <20180910083731.o4rryvermyighbtp@sirius.home.kraxel.org>
References: <1536491489.4810.22.camel@collabora.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1536491489.4810.22.camel@collabora.com>
User-Agent: NeoMutt/20180716
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

  Hi,

> > +		fput(memfd);
> > +	}
> > +	memfd = NULL;
> Now memfd is NULL 

> > +	buf = dma_buf_export(&exp_info);
> > +	if (IS_ERR(buf)) {
> > +		ret = PTR_ERR(buf);
> > +		goto err_put_pages;
> Assume an error occured 

> > +err_put_pages:
> > +	while (pgbuf > 0)
> > +		put_page(ubuf->pages[--pgbuf]);
> > +err_free_ubuf:
> > +	fput(memfd);
> Now fput it called with NULL, and in fput this is used in 

> where the bug is signalled, so I guess fput doesn't accept a null
> pointer. 

Indeed.  Already fixed in drm-misc-next.

> I'm not sure why you set memfd to NULL at all, because on the following
> non-error path it is not used.

And in the error path it should not be user either, at least when the
error happens *after* exiting the loop, otherwise we would fput twice in
the error case.

> The other question is of course, why did dma_buf_export fail for me ...

What exactly did you try?

cheers,
  Gerd