lkml.org 
[lkml]   [2017]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.12 192/196] drm/i915/fbdev: Check for existence of ifbdev->vma before operations
    Date
    4.12-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Chris Wilson <chris@chris-wilson.co.uk>

    commit 7581d5ca2bb269cfc2ce2d0cb489aac513167f6b upstream.

    Commit fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer
    flushes") adds a dependency to ifbdev->vma when flushing the framebufer,
    but the checks are only against the existence of the ifbdev->fb and not
    against ifbdev->vma. This leaves a window of opportunity where we may
    try to operate on the fbdev prior to it being probed (thanks to
    asynchronous booting).

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101534
    Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    Cc: Daniel Vetter <daniel.vetter@intel.com>
    Link: http://patchwork.freedesktop.org/patch/msgid/20170622160211.783-1-chris@chris-wilson.co.uk
    Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
    (cherry picked from commit 15727ed0d944ce1dec8b9e1082dd3df29a0fdf44)
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/i915/intel_fbdev.c | 11 ++++++-----
    1 file changed, 6 insertions(+), 5 deletions(-)

    --- a/drivers/gpu/drm/i915/intel_fbdev.c
    +++ b/drivers/gpu/drm/i915/intel_fbdev.c
    @@ -535,13 +535,14 @@ static void intel_fbdev_destroy(struct i

    drm_fb_helper_fini(&ifbdev->helper);

    - if (ifbdev->fb) {
    + if (ifbdev->vma) {
    mutex_lock(&ifbdev->helper.dev->struct_mutex);
    intel_unpin_fb_vma(ifbdev->vma);
    mutex_unlock(&ifbdev->helper.dev->struct_mutex);
    + }

    + if (ifbdev->fb)
    drm_framebuffer_remove(&ifbdev->fb->base);
    - }

    kfree(ifbdev);
    }
    @@ -765,7 +766,7 @@ void intel_fbdev_set_suspend(struct drm_
    struct intel_fbdev *ifbdev = dev_priv->fbdev;
    struct fb_info *info;

    - if (!ifbdev || !ifbdev->fb)
    + if (!ifbdev || !ifbdev->vma)
    return;

    info = ifbdev->helper.fbdev;
    @@ -812,7 +813,7 @@ void intel_fbdev_output_poll_changed(str
    {
    struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;

    - if (ifbdev && ifbdev->fb)
    + if (ifbdev && ifbdev->vma)
    drm_fb_helper_hotplug_event(&ifbdev->helper);
    }

    @@ -824,7 +825,7 @@ void intel_fbdev_restore_mode(struct drm
    return;

    intel_fbdev_sync(ifbdev);
    - if (!ifbdev->fb)
    + if (!ifbdev->vma)
    return;

    if (drm_fb_helper_restore_fbdev_mode_unlocked(&ifbdev->helper) == 0)

    \
     
     \ /
      Last update: 2017-07-25 21:27    [W:4.166 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site