Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 52b679f6 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2017-01-31' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes 

2 patches to fix the oops Dave Hanse reported, plus a double kfree fix
Maarten discovered while backporting the fix for Linus.

For Linus' vma tracking oops the plan is to send you a dedicated pull with
the 2 patches we need, but since it's tricky we're letting CI beat on it a
bit more.

* tag 'drm-misc-fixes-2017-01-31' of git://anongit.freedesktop.org/git/drm-misc:
  drm/atomic: Fix double free in drm_atomic_state_default_clear
  drm: Don't race connector registration
  drm: prevent double-(un)registration for connectors
parents edc67410 92c715fc

drivers/gpu/drm/drm_atomic.c

+8 −5
Original line number Diff line number Diff line
@@ -2032,13 +2032,16 @@ static void complete_crtc_signaling(struct drm_device *dev, 
	}



	for_each_crtc_in_state(state, crtc, crtc_state, i) {

		struct drm_pending_vblank_event *event = crtc_state->event;

		/*

		 * TEST_ONLY and PAGE_FLIP_EVENT are mutually

		 * exclusive, if they weren't, this code should be

		 * called on success for TEST_ONLY too.

		 * Free the allocated event. drm_atomic_helper_setup_commit

		 * can allocate an event too, so only free it if it's ours

		 * to prevent a double free in drm_atomic_state_clear.

		 */

		if (crtc_state->event)

			drm_event_cancel_free(dev, &crtc_state->event->base);

		if (event && (event->base.fence || event->base.file_priv)) {

			drm_event_cancel_free(dev, &event->base);

			crtc_state->event = NULL;

		}

	}



	if (!fence_state)

drivers/gpu/drm/drm_connector.c

+18 −5
Original line number Diff line number Diff line
@@ -225,6 +225,7 @@ int drm_connector_init(struct drm_device *dev, 


	INIT_LIST_HEAD(&connector->probed_modes);

	INIT_LIST_HEAD(&connector->modes);

	mutex_init(&connector->mutex);

	connector->edid_blob_ptr = NULL;

	connector->status = connector_status_unknown;
@@ -359,6 +360,8 @@ void drm_connector_cleanup(struct drm_connector *connector) 
		connector->funcs->atomic_destroy_state(connector,

						       connector->state);



	mutex_destroy(&connector->mutex);



	memset(connector, 0, sizeof(*connector));

}

EXPORT_SYMBOL(drm_connector_cleanup);
@@ -374,14 +377,18 @@ EXPORT_SYMBOL(drm_connector_cleanup); 
 */

int drm_connector_register(struct drm_connector *connector)

{

	int ret;

	int ret = 0;



	if (connector->registered)

	if (!connector->dev->registered)

		return 0;



	mutex_lock(&connector->mutex);

	if (connector->registered)

		goto unlock;



	ret = drm_sysfs_connector_add(connector);

	if (ret)

		return ret;

		goto unlock;



	ret = drm_debugfs_connector_add(connector);

	if (ret) {
@@ -397,12 +404,14 @@ int drm_connector_register(struct drm_connector *connector) 
	drm_mode_object_register(connector->dev, &connector->base);



	connector->registered = true;

	return 0;

	goto unlock;



err_debugfs:

	drm_debugfs_connector_remove(connector);

err_sysfs:

	drm_sysfs_connector_remove(connector);

unlock:

	mutex_unlock(&connector->mutex);

	return ret;

}

EXPORT_SYMBOL(drm_connector_register);
@@ -415,8 +424,11 @@ EXPORT_SYMBOL(drm_connector_register); 
 */

void drm_connector_unregister(struct drm_connector *connector)

{

	if (!connector->registered)

	mutex_lock(&connector->mutex);

	if (!connector->registered) {

		mutex_unlock(&connector->mutex);

		return;

	}



	if (connector->funcs->early_unregister)

		connector->funcs->early_unregister(connector);
@@ -425,6 +437,7 @@ void drm_connector_unregister(struct drm_connector *connector) 
	drm_debugfs_connector_remove(connector);



	connector->registered = false;

	mutex_unlock(&connector->mutex);

}

EXPORT_SYMBOL(drm_connector_unregister);

drivers/gpu/drm/drm_drv.c

+4 −0
Original line number Diff line number Diff line
@@ -745,6 +745,8 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) 
	if (ret)

		goto err_minors;



	dev->registered = true;



	if (dev->driver->load) {

		ret = dev->driver->load(dev, flags);

		if (ret)
@@ -785,6 +787,8 @@ void drm_dev_unregister(struct drm_device *dev) 


	drm_lastclose(dev);



	dev->registered = false;



	if (drm_core_check_feature(dev, DRIVER_MODESET))

		drm_modeset_unregister_all(dev);

include/drm/drmP.h

+1 −0
Original line number Diff line number Diff line
@@ -517,6 +517,7 @@ struct drm_device { 
	struct drm_minor *control;		/**< Control node */

	struct drm_minor *primary;		/**< Primary node */

	struct drm_minor *render;		/**< Render node */

	bool registered;



	/* currently active master for this device. Protected by master_mutex */

	struct drm_master *master;

include/drm/drm_connector.h

+15 −1
Original line number Diff line number Diff line
@@ -381,6 +381,8 @@ struct drm_connector_funcs { 
	 * core drm connector interfaces. Everything added from this callback

	 * should be unregistered in the early_unregister callback.

	 *

	 * This is called while holding drm_connector->mutex.

	 *

	 * Returns:

	 *

	 * 0 on success, or a negative error code on failure.
@@ -395,6 +397,8 @@ struct drm_connector_funcs { 
	 * late_register(). It is called from drm_connector_unregister(),

	 * early in the driver unload sequence to disable userspace access

	 * before data structures are torndown.

	 *

	 * This is called while holding drm_connector->mutex.

	 */

	void (*early_unregister)(struct drm_connector *connector);
@@ -559,7 +563,6 @@ struct drm_cmdline_mode { 
 * @interlace_allowed: can this connector handle interlaced modes?

 * @doublescan_allowed: can this connector handle doublescan?

 * @stereo_allowed: can this connector handle stereo modes?

 * @registered: is this connector exposed (registered) with userspace?

 * @modes: modes available on this connector (from fill_modes() + user)

 * @status: one of the drm_connector_status enums (connected, not, or unknown)

 * @probed_modes: list of modes derived directly from the display
@@ -607,6 +610,13 @@ struct drm_connector { 


	char *name;



	/**

	 * @mutex: Lock for general connector state, but currently only protects

	 * @registered. Most of the connector state is still protected by the

	 * mutex in &drm_mode_config.

	 */

	struct mutex mutex;



	/**

	 * @index: Compacted connector index, which matches the position inside

	 * the mode_config.list for drivers not supporting hot-add/removing. Can
@@ -620,6 +630,10 @@ struct drm_connector { 
	bool interlace_allowed;

	bool doublescan_allowed;

	bool stereo_allowed;

	/**

	 * @registered: Is this connector exposed (registered) with userspace?

	 * Protected by @mutex.

	 */

	bool registered;

	struct list_head modes; /* list of modes on this connector */