Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 631794b4 authored by Patrik Jakobsson's avatar Patrik Jakobsson
Browse files

drm/gma500: Lock struct_mutex around cursor updates 

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64361


Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarPatrik Jakobsson <patrik.r.jakobsson@gmail.com>
parent a4ab86bc

drivers/gpu/drm/gma500/gma_display.c

+10 −2
Original line number Diff line number Diff line
@@ -349,6 +349,7 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc, 
	/* If we didn't get a handle then turn the cursor off */

	if (!handle) {

		temp = CURSOR_MODE_DISABLE;

		mutex_lock(&dev->struct_mutex);



		if (gma_power_begin(dev, false)) {

			REG_WRITE(control, temp);
@@ -365,6 +366,7 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc, 
			gma_crtc->cursor_obj = NULL;

		}



		mutex_unlock(&dev->struct_mutex);

		return 0;

	}
@@ -374,9 +376,12 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc, 
		return -EINVAL;

	}



	mutex_lock(&dev->struct_mutex);

	obj = drm_gem_object_lookup(dev, file_priv, handle);

	if (!obj)

		return -ENOENT;

	if (!obj) {

		ret = -ENOENT;

		goto unlock;

	}



	if (obj->size < width * height * 4) {

		dev_dbg(dev->dev, "Buffer is too small\n");
@@ -440,10 +445,13 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc, 
	}



	gma_crtc->cursor_obj = obj;

unlock:

	mutex_unlock(&dev->struct_mutex);

	return ret;



unref_cursor:

	drm_gem_object_unreference(obj);

	mutex_unlock(&dev->struct_mutex);

	return ret;

}