diff mbox

[5/8] drm/tegra: dc: Fix a potential race on page-flip completion

Message ID 1418746515-24773-6-git-send-email-thierry.reding@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Thierry Reding Dec. 16, 2014, 4:15 p.m. UTC 
From: Thierry Reding <treding@nvidia.com>

Page-flip completion could race with page-flip submission, so extend the
critical section to include all accesses to page-flip related data.

Reported-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
---
 drivers/gpu/drm/tegra/dc.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

Comments

Alexandre Courbot Dec. 18, 2014, 1:45 p.m. UTC | #1 
On Wed, Dec 17, 2014 at 1:15 AM, Thierry Reding
<thierry.reding@gmail.com> wrote:
> From: Thierry Reding <treding@nvidia.com>
>
> Page-flip completion could race with page-flip submission, so extend the
> critical section to include all accesses to page-flip related data.
>
> Reported-by: Alexandre Courbot <acourbot@nvidia.com>
> Signed-off-by: Thierry Reding <treding@nvidia.com>

Tested-by: Alexandre Courbot <acourbot@nvidia.com>

Thanks, now I can finally do ovenight testing! :)
diff mbox

Patch

diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 4c6a8a828475..28040f7e4a43 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -814,8 +814,12 @@  static void tegra_dc_finish_page_flip(struct tegra_dc *dc)
 	unsigned long flags, base;
 	struct tegra_bo *bo;
 
-	if (!dc->event)
+	spin_lock_irqsave(&drm->event_lock, flags);
+
+	if (!dc->event) {
+		spin_unlock_irqrestore(&drm->event_lock, flags);
 		return;
+	}
 
 	bo = tegra_fb_get_plane(crtc->primary->fb, 0);
 
@@ -825,12 +829,12 @@  static void tegra_dc_finish_page_flip(struct tegra_dc *dc)
 	tegra_dc_writel(dc, 0, DC_CMD_STATE_ACCESS);
 
 	if (base == bo->paddr + crtc->primary->fb->offsets[0]) {
-		spin_lock_irqsave(&drm->event_lock, flags);
 		drm_crtc_send_vblank_event(crtc, dc->event);
 		drm_crtc_vblank_put(crtc);
 		dc->event = NULL;
-		spin_unlock_irqrestore(&drm->event_lock, flags);
 	}
+
+	spin_unlock_irqrestore(&drm->event_lock, flags);
 }
 
 void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)