dri-devel Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm: Undo damage to page_flip_ioctl
@ 2016-10-03  8:28 Daniel Vetter
  2016-10-03  8:35 ` Michel Dänzer
  0 siblings, 1 reply; 3+ messages in thread
From: Daniel Vetter @ 2016-10-03  8:28 UTC (permalink / raw)
  To: DRI Development; +Cc: Daniel Vetter, Michel Dänzer

I screwed up rebasing of my patch in

commit 43968d7b806d7a7e021261294c583a216fddf0e5
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Wed Sep 21 10:59:24 2016 +0200

    drm: Extract drm_plane.[hc]

which meant on error paths drm_crtc_vblank_put could be called without
a get, leading to an underrun of the refcount.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98020
Cc: Sean Paul <seanpaul@chromium.org>
Cc: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
---
 drivers/gpu/drm/drm_plane.c | 81 ++++++++++++++++++++++-----------------------
 1 file changed, 39 insertions(+), 42 deletions(-)

diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 783aef8acab7..249c0ae52c6d 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -783,6 +783,45 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
 	if (!crtc)
 		return -ENOENT;
 
+	if (crtc->funcs->page_flip_target) {
+		u32 current_vblank;
+		int r;
+
+		r = drm_crtc_vblank_get(crtc);
+		if (r)
+			return r;
+
+		current_vblank = drm_crtc_vblank_count(crtc);
+
+		switch (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) {
+		case DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE:
+			if ((int)(target_vblank - current_vblank) > 1) {
+				DRM_DEBUG("Invalid absolute flip target %u, "
+					  "must be <= %u\n", target_vblank,
+					  current_vblank + 1);
+				drm_crtc_vblank_put(crtc);
+				return -EINVAL;
+			}
+			break;
+		case DRM_MODE_PAGE_FLIP_TARGET_RELATIVE:
+			if (target_vblank != 0 && target_vblank != 1) {
+				DRM_DEBUG("Invalid relative flip target %u, "
+					  "must be 0 or 1\n", target_vblank);
+				drm_crtc_vblank_put(crtc);
+				return -EINVAL;
+			}
+			target_vblank += current_vblank;
+			break;
+		default:
+			target_vblank = current_vblank +
+				!(page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC);
+			break;
+		}
+	} else if (crtc->funcs->page_flip == NULL ||
+		   (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET)) {
+		return -EINVAL;
+	}
+
 	drm_modeset_lock_crtc(crtc, crtc->primary);
 	if (crtc->primary->fb == NULL) {
 		/* The framebuffer is currently unbound, presumably
@@ -793,9 +832,6 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
 		goto out;
 	}
 
-	if (crtc->funcs->page_flip == NULL)
-		goto out;
-
 	fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
 	if (!fb) {
 		ret = -ENOENT;
@@ -839,45 +875,6 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
 	}
 
 	crtc->primary->old_fb = crtc->primary->fb;
-	if (crtc->funcs->page_flip_target) {
-		u32 current_vblank;
-		int r;
-
-		r = drm_crtc_vblank_get(crtc);
-		if (r)
-			return r;
-
-		current_vblank = drm_crtc_vblank_count(crtc);
-
-		switch (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) {
-		case DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE:
-			if ((int)(target_vblank - current_vblank) > 1) {
-				DRM_DEBUG("Invalid absolute flip target %u, "
-					  "must be <= %u\n", target_vblank,
-					  current_vblank + 1);
-				drm_crtc_vblank_put(crtc);
-				return -EINVAL;
-			}
-			break;
-		case DRM_MODE_PAGE_FLIP_TARGET_RELATIVE:
-			if (target_vblank != 0 && target_vblank != 1) {
-				DRM_DEBUG("Invalid relative flip target %u, "
-					  "must be 0 or 1\n", target_vblank);
-				drm_crtc_vblank_put(crtc);
-				return -EINVAL;
-			}
-			target_vblank += current_vblank;
-			break;
-		default:
-			target_vblank = current_vblank +
-				!(page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC);
-			break;
-		}
-	} else if (crtc->funcs->page_flip == NULL ||
-		   (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET)) {
-		return -EINVAL;
-	}
-
 	if (crtc->funcs->page_flip_target)
 		ret = crtc->funcs->page_flip_target(crtc, fb, e,
 						    page_flip->flags,
-- 
2.9.3

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH] drm: Undo damage to page_flip_ioctl
  2016-10-03  8:28 [PATCH] drm: Undo damage to page_flip_ioctl Daniel Vetter
@ 2016-10-03  8:35 ` Michel Dänzer
  2016-10-03 13:01   ` Daniel Vetter
  0 siblings, 1 reply; 3+ messages in thread
From: Michel Dänzer @ 2016-10-03  8:35 UTC (permalink / raw)
  To: Daniel Vetter; +Cc: DRI Development

On 03/10/16 05:28 PM, Daniel Vetter wrote:
> I screwed up rebasing of my patch in
> 
> commit 43968d7b806d7a7e021261294c583a216fddf0e5
> Author: Daniel Vetter <daniel.vetter@ffwll.ch>
> Date:   Wed Sep 21 10:59:24 2016 +0200
> 
>     drm: Extract drm_plane.[hc]
> 
> which meant on error paths drm_crtc_vblank_put could be called without
> a get, leading to an underrun of the refcount.
> 
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98020
> Cc: Sean Paul <seanpaul@chromium.org>
> Cc: Michel Dänzer <michel@daenzer.net>
> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>


-- 
Earthling Michel Dänzer               |               http://www.amd.com
Libre software enthusiast             |             Mesa and X developer
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [PATCH] drm: Undo damage to page_flip_ioctl
  2016-10-03  8:35 ` Michel Dänzer
@ 2016-10-03 13:01   ` Daniel Vetter
  0 siblings, 0 replies; 3+ messages in thread
From: Daniel Vetter @ 2016-10-03 13:01 UTC (permalink / raw)
  To: Michel Dänzer; +Cc: Daniel Vetter, DRI Development

On Mon, Oct 03, 2016 at 05:35:05PM +0900, Michel Dänzer wrote:
> On 03/10/16 05:28 PM, Daniel Vetter wrote:
> > I screwed up rebasing of my patch in
> > 
> > commit 43968d7b806d7a7e021261294c583a216fddf0e5
> > Author: Daniel Vetter <daniel.vetter@ffwll.ch>
> > Date:   Wed Sep 21 10:59:24 2016 +0200
> > 
> >     drm: Extract drm_plane.[hc]
> > 
> > which meant on error paths drm_crtc_vblank_put could be called without
> > a get, leading to an underrun of the refcount.
> > 
> > Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98020
> > Cc: Sean Paul <seanpaul@chromium.org>
> > Cc: Michel Dänzer <michel@daenzer.net>
> > Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> 
> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>

Applied to drm-misc, with the t-b from the bug report. Will send out the
pull request asap.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-10-03 13:01 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-03  8:28 [PATCH] drm: Undo damage to page_flip_ioctl Daniel Vetter
2016-10-03  8:35 ` Michel Dänzer
2016-10-03 13:01   ` Daniel Vetter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox