From patchwork Mon Jun 8 04:27:27 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Archit Taneja X-Patchwork-Id: 6562721 X-Patchwork-Delegate: agross@codeaurora.org Return-Path: X-Original-To: patchwork-linux-arm-msm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 38B9DC0020 for ; Mon, 8 Jun 2015 04:27:42 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 0773A20520 for ; Mon, 8 Jun 2015 04:27:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0950720511 for ; Mon, 8 Jun 2015 04:27:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750976AbbFHE1h (ORCPT ); Mon, 8 Jun 2015 00:27:37 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:33806 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751248AbbFHE1h (ORCPT ); Mon, 8 Jun 2015 00:27:37 -0400 Received: from smtp.codeaurora.org (localhost [127.0.0.1]) by smtp.codeaurora.org (Postfix) with ESMTP id 756C813FEE6; Mon, 8 Jun 2015 04:27:36 +0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 486) id 596A813FEF5; Mon, 8 Jun 2015 04:27:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from localhost (unknown [202.46.23.61]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: architt@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 7D59913FEE6; Mon, 8 Jun 2015 04:27:33 +0000 (UTC) From: Archit Taneja To: robdclark@gmail.com, sviau@codeaurora.org Cc: dri-devel@lists.freedesktop.org, linux-arm-msm@vger.kernel.org, Archit Taneja Subject: [PATCH] drm/msm: Fix mdp5_crtc->ctl NULL dereference Date: Mon, 8 Jun 2015 09:57:27 +0530 Message-Id: <1433737647-1926-1-git-send-email-architt@codeaurora.org> X-Mailer: git-send-email 1.8.2.1 X-Virus-Scanned: ClamAV using ClamSMTP Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP A race condition between drm_release and drm_mode_rmfb can result in mdp5_crtc_disable() accessing mdp5_crtc->ctl when its already been set to NULL by a complete_flip() which disables the crtc. Move the ctl register write within complete_flip() when the crtc state is disabled. Signed-off-by: Archit Taneja --- drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c index c153077..13dd7dd 100644 --- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c @@ -143,6 +143,8 @@ static void complete_flip(struct drm_crtc *crtc, struct drm_file *file) } if (mdp5_crtc->ctl && !crtc->state->enable) { + /* set STAGE_UNUSED for all layers */ + mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000); mdp5_ctl_release(mdp5_crtc->ctl); mdp5_crtc->ctl = NULL; } @@ -274,9 +276,6 @@ static void mdp5_crtc_disable(struct drm_crtc *crtc) if (WARN_ON(!mdp5_crtc->enabled)) return; - /* set STAGE_UNUSED for all layers */ - mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000); - mdp_irq_unregister(&mdp5_kms->base, &mdp5_crtc->err); mdp5_disable(mdp5_kms);