From patchwork Tue Mar 12 14:38:43 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Laurent Pinchart X-Patchwork-Id: 2257361 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by patchwork1.kernel.org (Postfix) with ESMTP id 4B4E23FCF6 for ; Tue, 12 Mar 2013 16:59:30 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 3C5DFE621D for ; Tue, 12 Mar 2013 09:59:30 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [95.142.166.194]) by gabe.freedesktop.org (Postfix) with ESMTP id 44F86E607B for ; Tue, 12 Mar 2013 07:38:13 -0700 (PDT) Received: from avalon.ideasonboard.com (unknown [91.178.254.242]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 1B2BB3598B for ; Tue, 12 Mar 2013 15:38:01 +0100 (CET) From: Laurent Pinchart To: dri-devel@lists.freedesktop.org Subject: [PATCH] drm/shmobile: Fix race condition between page flip request and handler Date: Tue, 12 Mar 2013 15:38:43 +0100 Message-Id: <1363099123-4911-1-git-send-email-laurent.pinchart+renesas@ideasonboard.com> X-Mailer: git-send-email 1.8.1.5 X-Mailman-Approved-At: Tue, 12 Mar 2013 09:54:53 -0700 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org The page flip handler stores the page flip event pointer and then calls drm_vblank_get() to enable the vblank interrupt. Due to the vblank off delay, the vblank interrupt can be enabled in the hardware at that point, even if the vblank reference count is equal to 0. If a vblank interrupt is triggered between storing the event pointer and calling drm_vblank_get(), the page flip completion handler will process the event and call drm_vblank_put() with a reference count equal to 0. This will result in a BUG_ON. Fix the race condition by calling drm_vblank_get() before storing the event pointer. Signed-off-by: Laurent Pinchart --- drivers/gpu/drm/shmobile/shmob_drm_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/shmobile/shmob_drm_crtc.c b/drivers/gpu/drm/shmobile/shmob_drm_crtc.c index d917a41..7dff49e 100644 --- a/drivers/gpu/drm/shmobile/shmob_drm_crtc.c +++ b/drivers/gpu/drm/shmobile/shmob_drm_crtc.c @@ -494,10 +494,10 @@ static int shmob_drm_crtc_page_flip(struct drm_crtc *crtc, if (event) { event->pipe = 0; + drm_vblank_get(dev, 0); spin_lock_irqsave(&dev->event_lock, flags); scrtc->event = event; spin_unlock_irqrestore(&dev->event_lock, flags); - drm_vblank_get(dev, 0); } return 0;