Skip to contentSkip to conversation

FAILED: patch "[PATCH] drm/i915/fbdev: Check for existence of ifbdev->vma before" failed to apply to 4.12-stable tree

PATCH [email protected] 1 participant 1 message Sep 4, 2017

Subsystems (3)
Stable branch DRM drivers Intel i915
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From 15727ed0d944ce1dec8b9e1082dd3df29a0fdf44 Mon Sep 17 00:00:00 2001

From: Chris Wilson <[email protected]>
Date: Thu, 22 Jun 2017 17:02:11 +0100
Subject: [PATCH] drm/i915/fbdev: Check for existence of ifbdev->vma before
operations

Commit fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes") adds a dependency to ifbdev->vma when flushing the framebufer, but the checks are only against the existence of the ifbdev->fb and not against ifbdev->vma. This leaves a window of opportunity where we may try to operate on the fbdev prior to it being probed (thanks to asynchronous booting).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101534

Fixes fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
Signed-off-by Chris Wilson <[email protected]>
Cc Joonas Lahtinen <[email protected]>
Cc Daniel Vetter <[email protected]>
Link http://patchwork.freedesktop.org/patch/msgid/[email protected]
Reviewed-by Tvrtko Ursulin <[email protected]>
Cc [email protected]
drivers/gpu/drm/i915/intel_fbdev.c +6 -5
index 03347c6ae599..0c4cde6b2e6f 100644
@@ -535,13 +535,14 @@ static void intel_fbdev_destroy(struct intel_fbdev *ifbdev)
 
 	drm_fb_helper_fini(&ifbdev->helper);
 
-	if (ifbdev->fb) {
+	if (ifbdev->vma) {
 		mutex_lock(&ifbdev->helper.dev->struct_mutex);
 		intel_unpin_fb_vma(ifbdev->vma);
 		mutex_unlock(&ifbdev->helper.dev->struct_mutex);
+	}
 
+	if (ifbdev->fb)
 		drm_framebuffer_remove(&ifbdev->fb->base);
-	}
 
 	kfree(ifbdev);
 }

@@ -765,7 +766,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
 	struct intel_fbdev *ifbdev = dev_priv->fbdev;
 	struct fb_info *info;
 
-	if (!ifbdev || !ifbdev->fb)
+	if (!ifbdev || !ifbdev->vma)
 		return;
 
 	info = ifbdev->helper.fbdev;

@@ -812,7 +813,7 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev)
 {
 	struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
 
-	if (ifbdev && ifbdev->fb)
+	if (ifbdev && ifbdev->vma)
 		drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 

@@ -824,7 +825,7 @@ void intel_fbdev_restore_mode(struct drm_device *dev)
 		return;
 
 	intel_fbdev_sync(ifbdev);
-	if (!ifbdev->fb)
+	if (!ifbdev->vma)
 		return;
 
 	if (drm_fb_helper_restore_fbdev_mode_unlocked(&ifbdev->helper) == 0)