drm/tegra: dc: Fix a potential race on page-flip completion

Page-flip completion could race with page-flip submission, so extend the
critical section to include all accesses to page-flip related data.

Reported-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
This commit is contained in:
Thierry Reding 2014-12-16 16:33:27 +01:00
parent ed7dae58de
commit 6b59cc1c86

View File

@ -814,8 +814,12 @@ static void tegra_dc_finish_page_flip(struct tegra_dc *dc)
unsigned long flags, base;
struct tegra_bo *bo;
if (!dc->event)
spin_lock_irqsave(&drm->event_lock, flags);
if (!dc->event) {
spin_unlock_irqrestore(&drm->event_lock, flags);
return;
}
bo = tegra_fb_get_plane(crtc->primary->fb, 0);
@ -825,12 +829,12 @@ static void tegra_dc_finish_page_flip(struct tegra_dc *dc)
tegra_dc_writel(dc, 0, DC_CMD_STATE_ACCESS);
if (base == bo->paddr + crtc->primary->fb->offsets[0]) {
spin_lock_irqsave(&drm->event_lock, flags);
drm_crtc_send_vblank_event(crtc, dc->event);
drm_crtc_vblank_put(crtc);
dc->event = NULL;
spin_unlock_irqrestore(&drm->event_lock, flags);
}
spin_unlock_irqrestore(&drm->event_lock, flags);
}
void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)