releases/3.0.72/drm-i915-don-t-set-unpin_work-if-vblank_get-fails.patch

   1 From 7317c75e66fce0c9f82fbe6f72f7e5256b315422 Mon Sep 17 00:00:00 2001
   2 From: Jesse Barnes <jbarnes@virtuousgeek.org>
   3 Date: Mon, 29 Aug 2011 09:45:28 -0700
   4 Subject: drm/i915: don't set unpin_work if vblank_get fails
   5
   6 From: Jesse Barnes <jbarnes@virtuousgeek.org>
   7
   8 commit 7317c75e66fce0c9f82fbe6f72f7e5256b315422 upstream.
   9
  10 This fixes a race where we may try to finish a page flip and decrement
  11 the refcount even if our vblank_get failed and we ended up with a
  12 spurious flip pending interrupt.
  13
  14 Fixes https://bugs.freedesktop.org/show_bug.cgi?id=34211.
  15
  16 Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
  17 Signed-off-by: Keith Packard <keithp@keithp.com>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19
  20 ---
  21  drivers/gpu/drm/i915/intel_display.c |   12 +++++++-----
  22  1 file changed, 7 insertions(+), 5 deletions(-)
  23
  24 --- a/drivers/gpu/drm/i915/intel_display.c
  25 +++ b/drivers/gpu/drm/i915/intel_display.c
  26 @@ -6524,11 +6524,16 @@ static int intel_crtc_page_flip(struct d
  27         work->old_fb_obj = intel_fb->obj;
  28         INIT_WORK(&work->work, intel_unpin_work_fn);
  29
  30 +       ret = drm_vblank_get(dev, intel_crtc->pipe);
  31 +       if (ret)
  32 +               goto free_work;
  33 +
  34         /* We borrow the event spin lock for protecting unpin_work */
  35         spin_lock_irqsave(&dev->event_lock, flags);
  36         if (intel_crtc->unpin_work) {
  37                 spin_unlock_irqrestore(&dev->event_lock, flags);
  38                 kfree(work);
  39 +               drm_vblank_put(dev, intel_crtc->pipe);
  40
  41                 DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
  42                 return -EBUSY;
  43 @@ -6547,10 +6552,6 @@ static int intel_crtc_page_flip(struct d
  44
  45         crtc->fb = fb;
  46
  47 -       ret = drm_vblank_get(dev, intel_crtc->pipe);
  48 -       if (ret)
  49 -               goto cleanup_objs;
  50 -
  51         work->pending_flip_obj = obj;
  52
  53         work->enable_stall_check = true;
  54 @@ -6572,7 +6573,6 @@ static int intel_crtc_page_flip(struct d
  55
  56  cleanup_pending:
  57         atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
  58 -cleanup_objs:
  59         drm_gem_object_unreference(&work->old_fb_obj->base);
  60         drm_gem_object_unreference(&obj->base);
  61         mutex_unlock(&dev->struct_mutex);
  62 @@ -6581,6 +6581,8 @@ cleanup_objs:
  63         intel_crtc->unpin_work = NULL;
  64         spin_unlock_irqrestore(&dev->event_lock, flags);
  65
  66 +       drm_vblank_put(dev, intel_crtc->pipe);
  67 +free_work:
  68         kfree(work);
  69
  70         return ret;