Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac51bb09 authored by Peter Hurley's avatar Peter Hurley Committed by Ben Skeggs
Browse files

drm/nouveau/core: Allow asymmetric nouveau_event_get/_put 



Most nouveau event handlers have storage in 'static' containers
(structures with lifetimes nearly equivalent to the drm_device),
but are dangerously reused via nouveau_event_get/_put. For
example, if nouveau_event_get is called more than once for a
given handler, the event handler list will be corrupted.

Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 01925579

drivers/gpu/drm/nouveau/core/core/event.c

+12 −8
Original line number Original line Diff line number Diff line
@@ -27,12 +27,14 @@ static void 
nouveau_event_put_locked(struct nouveau_event *event, int index,

nouveau_event_put_locked(struct nouveau_event *event, int index,

			 struct nouveau_eventh *handler)

			 struct nouveau_eventh *handler)

{

{

	if (__test_and_clear_bit(NVKM_EVENT_ENABLE, &handler->flags)) {

		if (!--event->index[index].refs) {

		if (!--event->index[index].refs) {

			if (event->disable)

			if (event->disable)

				event->disable(event, index);

				event->disable(event, index);

		}

		}

		list_del(&handler->head);

		list_del(&handler->head);

	}

	}

}





void

void

nouveau_event_put(struct nouveau_event *event, int index,

nouveau_event_put(struct nouveau_event *event, int index,
@@ -58,11 +60,13 @@ nouveau_event_get(struct nouveau_event *event, int index, 
		return;

		return;





	spin_lock_irqsave(&event->lock, flags);

	spin_lock_irqsave(&event->lock, flags);

	if (!__test_and_set_bit(NVKM_EVENT_ENABLE, &handler->flags)) {

		list_add(&handler->head, &event->index[index].list);

		list_add(&handler->head, &event->index[index].list);

		if (!event->index[index].refs++) {

		if (!event->index[index].refs++) {

			if (event->enable)

			if (event->enable)

				event->enable(event, index);

				event->enable(event, index);

		}

		}

	}

	spin_unlock_irqrestore(&event->lock, flags);

	spin_unlock_irqrestore(&event->lock, flags);

}

}

drivers/gpu/drm/nouveau/core/include/core/event.h

+4 −0
Original line number Original line Diff line number Diff line
@@ -5,8 +5,12 @@ 
#define NVKM_EVENT_DROP 0

#define NVKM_EVENT_DROP 0

#define NVKM_EVENT_KEEP 1

#define NVKM_EVENT_KEEP 1





/* nouveau_eventh.flags bit #s */

#define NVKM_EVENT_ENABLE 0



struct nouveau_eventh {

struct nouveau_eventh {

	struct list_head head;

	struct list_head head;

	unsigned long flags;

	void *priv;

	void *priv;

	int (*func)(struct nouveau_eventh *, int index);

	int (*func)(struct nouveau_eventh *, int index);

};

};

drivers/gpu/drm/nouveau/nouveau_drm.c

+2 −6
Original line number Original line Diff line number Diff line
@@ -95,7 +95,6 @@ nouveau_drm_vblank_enable(struct drm_device *dev, int head) 




	if (WARN_ON_ONCE(head >= ARRAY_SIZE(drm->vblank)))

	if (WARN_ON_ONCE(head >= ARRAY_SIZE(drm->vblank)))

		return -EIO;

		return -EIO;

	WARN_ON_ONCE(drm->vblank[head].func);

	drm->vblank[head].func = nouveau_drm_vblank_handler;

	drm->vblank[head].func = nouveau_drm_vblank_handler;

	nouveau_event_get(pdisp->vblank, head, &drm->vblank[head]);

	nouveau_event_get(pdisp->vblank, head, &drm->vblank[head]);

	return 0;

	return 0;
@@ -106,11 +105,8 @@ nouveau_drm_vblank_disable(struct drm_device *dev, int head) 
{

{

	struct nouveau_drm *drm = nouveau_drm(dev);

	struct nouveau_drm *drm = nouveau_drm(dev);

	struct nouveau_disp *pdisp = nouveau_disp(drm->device);

	struct nouveau_disp *pdisp = nouveau_disp(drm->device);

	if (drm->vblank[head].func)



	nouveau_event_put(pdisp->vblank, head, &drm->vblank[head]);

	nouveau_event_put(pdisp->vblank, head, &drm->vblank[head]);

	else

		WARN_ON_ONCE(1);

	drm->vblank[head].func = NULL;

}

}





static u64

static u64