Attachment 126960 Details for Bug 98020 – undo page_flip ioctl damage

[patch] undo page_flip ioctl damage

0001-drm-Undo-damage-to-page_flip_ioctl.patch (text/plain), 3.53 KB, created by Daniel Vetter on 2016-10-03 08:22:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Vetter

Created: 2016-10-03 08:22:33 UTC

Size: 3.53 KB

patch

obsolete

>From da98b327a3a71aa12e854d5b1f3dd4edd84679b2 Mon Sep 17 00:00:00 2001
>From: Daniel Vetter <daniel.vetter@ffwll.ch>
>Date: Mon, 3 Oct 2016 10:20:42 +0200
>Subject: [PATCH] drm: Undo damage to page_flip_ioctl
>
>I screwed up rebasing of my patch in
>
>commit 43968d7b806d7a7e021261294c583a216fddf0e5
>Author: Daniel Vetter <daniel.vetter@ffwll.ch>
>Date:   Wed Sep 21 10:59:24 2016 +0200
>
>    drm: Extract drm_plane.[hc]
>
>which meant on error paths drm_crtc_vblank_put could be called without
>a get, leading to an underrun of the refcount.
>
>Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98020
>Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
>---
> drivers/gpu/drm/drm_plane.c | 78 ++++++++++++++++++++++-----------------------
> 1 file changed, 39 insertions(+), 39 deletions(-)
>
>diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
>index 783aef8acab7..1c965997d5bd 100644
>--- a/drivers/gpu/drm/drm_plane.c
>+++ b/drivers/gpu/drm/drm_plane.c
>@@ -783,6 +783,45 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
> 	if (!crtc)
> 		return -ENOENT;
> 
>+	if (crtc->funcs->page_flip_target) {
>+		u32 current_vblank;
>+		int r;
>+
>+		r = drm_crtc_vblank_get(crtc);
>+		if (r)
>+			return r;
>+
>+		current_vblank = drm_crtc_vblank_count(crtc);
>+
>+		switch (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) {
>+		case DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE:
>+			if ((int)(target_vblank - current_vblank) > 1) {
>+				DRM_DEBUG("Invalid absolute flip target %u, "
>+					  "must be <= %u\n", target_vblank,
>+					  current_vblank + 1);
>+				drm_crtc_vblank_put(crtc);
>+				return -EINVAL;
>+			}
>+			break;
>+		case DRM_MODE_PAGE_FLIP_TARGET_RELATIVE:
>+			if (target_vblank != 0 && target_vblank != 1) {
>+				DRM_DEBUG("Invalid relative flip target %u, "
>+					  "must be 0 or 1\n", target_vblank);
>+				drm_crtc_vblank_put(crtc);
>+				return -EINVAL;
>+			}
>+			target_vblank += current_vblank;
>+			break;
>+		default:
>+			target_vblank = current_vblank +
>+				!(page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC);
>+			break;
>+		}
>+	} else if (crtc->funcs->page_flip == NULL ||
>+		   (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET)) {
>+		return -EINVAL;
>+	}
>+
> 	drm_modeset_lock_crtc(crtc, crtc->primary);
> 	if (crtc->primary->fb == NULL) {
> 		/* The framebuffer is currently unbound, presumably
>@@ -839,45 +878,6 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
> 	}
> 
> 	crtc->primary->old_fb = crtc->primary->fb;
>-	if (crtc->funcs->page_flip_target) {
>-		u32 current_vblank;
>-		int r;
>-
>-		r = drm_crtc_vblank_get(crtc);
>-		if (r)
>-			return r;
>-
>-		current_vblank = drm_crtc_vblank_count(crtc);
>-
>-		switch (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET) {
>-		case DRM_MODE_PAGE_FLIP_TARGET_ABSOLUTE:
>-			if ((int)(target_vblank - current_vblank) > 1) {
>-				DRM_DEBUG("Invalid absolute flip target %u, "
>-					  "must be <= %u\n", target_vblank,
>-					  current_vblank + 1);
>-				drm_crtc_vblank_put(crtc);
>-				return -EINVAL;
>-			}
>-			break;
>-		case DRM_MODE_PAGE_FLIP_TARGET_RELATIVE:
>-			if (target_vblank != 0 && target_vblank != 1) {
>-				DRM_DEBUG("Invalid relative flip target %u, "
>-					  "must be 0 or 1\n", target_vblank);
>-				drm_crtc_vblank_put(crtc);
>-				return -EINVAL;
>-			}
>-			target_vblank += current_vblank;
>-			break;
>-		default:
>-			target_vblank = current_vblank +
>-				!(page_flip->flags & DRM_MODE_PAGE_FLIP_ASYNC);
>-			break;
>-		}
>-	} else if (crtc->funcs->page_flip == NULL ||
>-		   (page_flip->flags & DRM_MODE_PAGE_FLIP_TARGET)) {
>-		return -EINVAL;
>-	}
>-
> 	if (crtc->funcs->page_flip_target)
> 		ret = crtc->funcs->page_flip_target(crtc, fb, e,
> 						    page_flip->flags,
>-- 
>2.9.3
>

Actions: View | Splinter Review

Attachments on bug 98020: 126960

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.