• Chris Wilson's avatar
    drm/i915: Fix race on unreferencing the wrong mmio-flip-request · b2cfe0ab
    Chris Wilson authored
    As we perform the mmio-flip without any locking and then try to acquire
    the struct_mutex prior to dereferencing the request, it is possible for
    userspace to queue a new pageflip before the worker can finish clearing
    the old state - and then it will clear the new flip request. The result
    is that the new flip could be completed before the GPU has finished
    rendering.
    
    The bugs stems from removing the seqno checking in
    commit 536f5b5e
    Author: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
    Date:   Thu Nov 6 11:03:40 2014 +0200
    
        drm/i915: Make mmio flip wait for seqno in the work function
    Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
    Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
    Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
    b2cfe0ab
intel_drv.h 47.6 KB