Skip to contentSkip to conversation

drm/msm: Fix mdp5_crtc->ctl NULL dereference

PATCH New Archit Taneja 1 participant 1 message Jun 8, 2015

Subsystems (3)
DRM drivers Arm Qualcomm mailing list DRM driver for Qualcomm display hardware
lore
Share & tools
lore

Archit Taneja

author
#0 lore raw

PATCH 1/1 drm/msm: Fix mdp5_crtc->ctl NULL dereference

A race condition between drm_release and drm_mode_rmfb can result in mdp5_crtc_disable() accessing mdp5_crtc->ctl when its already been set to NULL by a complete_flip() which disables the crtc.

Move the ctl register write within complete_flip() when the crtc state is disabled.

Signed-off-by Archit Taneja <[email protected]>
---
 drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c +2 -3
index c153077..13dd7dd 100644
@@ -143,6 +143,8 @@ static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
 	}
 
 	if (mdp5_crtc->ctl && !crtc->state->enable) {
+		/* set STAGE_UNUSED for all layers */
+		mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000);
 		mdp5_ctl_release(mdp5_crtc->ctl);
 		mdp5_crtc->ctl = NULL;
 	}

@@ -274,9 +276,6 @@ static void mdp5_crtc_disable(struct drm_crtc *crtc)
 	if (WARN_ON(!mdp5_crtc->enabled))
 		return;
 
-	/* set STAGE_UNUSED for all layers */
-	mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000);
-
 	mdp_irq_unregister(&mdp5_kms->base, &mdp5_crtc->err);
 	mdp5_disable(mdp5_kms);
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
hosted by The Linux Foundation