From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sean Paul Subject: [PATCH] drm: damage_helper: Fix race checking plane->state->fb Date: Wed, 4 Sep 2019 16:29:13 -0400 Message-ID: <20190904202938.110207-1-sean@poorly.run> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: Sender: stable-owner@vger.kernel.org To: dri-devel@lists.freedesktop.org Cc: Sean Paul , Rob Clark , Deepak Rawat , Daniel Vetter , Thomas Hellstrom , Maarten Lankhorst , Maxime Ripard , Sean Paul , David Airlie , Daniel Vetter , stable@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org From: Sean Paul Since the dirtyfb ioctl doesn't give us any hints as to which plane is scanning out the fb it's marking as damaged, we need to loop through planes to find it. Currently we just reach into plane state and check, but that can race with another commit changing the fb out from under us. This patch locks the plane before checking the fb and will release the lock if the plane is not displaying the dirty fb. Fixes: b9fc5e01d1ce ("drm: Add helper to implement legacy dirtyfb") Cc: Rob Clark Cc: Deepak Rawat Cc: Daniel Vetter Cc: Thomas Hellstrom Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sean Paul Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Cc: # v5.0+ Reported-by: Daniel Vetter Signed-off-by: Sean Paul --- drivers/gpu/drm/drm_damage_helper.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_damage_helper.c b/drivers/gpu/drm/drm_damage_helper.c index 8230dac01a89..3a4126dc2520 100644 --- a/drivers/gpu/drm/drm_damage_helper.c +++ b/drivers/gpu/drm/drm_damage_helper.c @@ -212,8 +212,14 @@ int drm_atomic_helper_dirtyfb(struct drm_framebuffer *fb, drm_for_each_plane(plane, fb->dev) { struct drm_plane_state *plane_state; - if (plane->state->fb != fb) + ret = drm_modeset_lock(&plane->mutex, state->acquire_ctx); + if (ret) + goto out; + + if (plane->state->fb != fb) { + drm_modeset_unlock(&plane->mutex); continue; + } plane_state = drm_atomic_get_plane_state(state, plane); if (IS_ERR(plane_state)) { -- Sean Paul, Software Engineer, Google / Chromium OS