Commit 15727ed0 authored by Chris Wilson's avatar Chris Wilson

drm/i915/fbdev: Check for existence of ifbdev->vma before operations

Commit fabef825 ("drm/i915: Drop struct_mutex around frontbuffer
flushes") adds a dependency to ifbdev->vma when flushing the framebufer,
but the checks are only against the existence of the ifbdev->fb and not
against ifbdev->vma. This leaves a window of opportunity where we may
try to operate on the fbdev prior to it being probed (thanks to
asynchronous booting).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101534
Fixes: fabef825 ("drm/i915: Drop struct_mutex around frontbuffer flushes")
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170622160211.783-1-chris@chris-wilson.co.ukReviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: stable@vger.kernel.org
parent fad20834
...@@ -535,13 +535,14 @@ static void intel_fbdev_destroy(struct intel_fbdev *ifbdev) ...@@ -535,13 +535,14 @@ static void intel_fbdev_destroy(struct intel_fbdev *ifbdev)
drm_fb_helper_fini(&ifbdev->helper); drm_fb_helper_fini(&ifbdev->helper);
if (ifbdev->fb) { if (ifbdev->vma) {
mutex_lock(&ifbdev->helper.dev->struct_mutex); mutex_lock(&ifbdev->helper.dev->struct_mutex);
intel_unpin_fb_vma(ifbdev->vma); intel_unpin_fb_vma(ifbdev->vma);
mutex_unlock(&ifbdev->helper.dev->struct_mutex); mutex_unlock(&ifbdev->helper.dev->struct_mutex);
}
if (ifbdev->fb)
drm_framebuffer_remove(&ifbdev->fb->base); drm_framebuffer_remove(&ifbdev->fb->base);
}
kfree(ifbdev); kfree(ifbdev);
} }
...@@ -765,7 +766,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous ...@@ -765,7 +766,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
struct intel_fbdev *ifbdev = dev_priv->fbdev; struct intel_fbdev *ifbdev = dev_priv->fbdev;
struct fb_info *info; struct fb_info *info;
if (!ifbdev || !ifbdev->fb) if (!ifbdev || !ifbdev->vma)
return; return;
info = ifbdev->helper.fbdev; info = ifbdev->helper.fbdev;
...@@ -812,7 +813,7 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev) ...@@ -812,7 +813,7 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev)
{ {
struct intel_fbdev *ifbdev = to_i915(dev)->fbdev; struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
if (ifbdev && ifbdev->fb) if (ifbdev && ifbdev->vma)
drm_fb_helper_hotplug_event(&ifbdev->helper); drm_fb_helper_hotplug_event(&ifbdev->helper);
} }
...@@ -824,7 +825,7 @@ void intel_fbdev_restore_mode(struct drm_device *dev) ...@@ -824,7 +825,7 @@ void intel_fbdev_restore_mode(struct drm_device *dev)
return; return;
intel_fbdev_sync(ifbdev); intel_fbdev_sync(ifbdev);
if (!ifbdev->fb) if (!ifbdev->vma)
return; return;
if (drm_fb_helper_restore_fbdev_mode_unlocked(&ifbdev->helper) == 0) if (drm_fb_helper_restore_fbdev_mode_unlocked(&ifbdev->helper) == 0)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment