• Ville Syrjälä's avatar
    drm/i915: Free pending page flip events at .preclose() · e2fcdaa9
    Ville Syrjälä authored
    If there are pending page flips when the fd gets closed those page
    flips may have events associated to them. When the page flip eventually
    completes it will queue the event to file_priv->event_list, but that
    may be too late and file_priv->event_list has already been cleaned up.
    Thus we leak a bit of kernel memory in the form of the event structure.
    
    To avoid such problems clear out such pending events from
    intel_crtc->unpin_work at ->preclose(). Any event that already made it
    to file_priv->event_list will get cleaned up by the drm_release_events()
    a bit later.
    
    We can ignore the file_priv->event_space accounting since file_priv is
    going away. This is already how drm core deals with pending vblank
    events, which are maintained by the drm core.
    
    What saves us from a total disaster (ie. dereferencing and alrady
    freed file_priv) is the fact that the fb descruction triggers a modeset
    and there we wait for pending flips.
    Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
    Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
    e2fcdaa9
intel_display.c 371 KB