drm/i915: Fix global state use-after-frees with a refcount

Browse source

While the current locking/serialization of the global state
suffices for protecting the obj->state access and the actual
hardware reprogramming, we do have a problem with accessing
the old/new states during nonblocking commits.

The state computation and swap will be protected by the crtc
locks, but the commit_tails can finish out of order, thus also
causing the atomic states to be cleaned up out of order. This
would mean the commit that started first but finished last has
had its new state freed as the no-longer-needed old state by the
other commit.

To fix this let's just refcount the states. obj->state amounts
to one reference, and the intel_atomic_state holds extra references
to both its new and old global obj states.

Fixes: 0ef1905ecf ("drm/i915: Introduce better global state handling")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200527200245.13184-1-ville.syrjala@linux.intel.com
Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
(cherry picked from commit f8c86ffa28)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>

...

This commit is contained in:

Ville Syrjälä 2020-05-27 23:02:45 +03:00 • committed by Joonas Lahtinen

parent 0e38695927

commit 882f38b7f6

2 changed files with 42 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

45

drivers/gpu/drm/i915/display/intel_global_state.c

View file

3

drivers/gpu/drm/i915/display/intel_global_state.h

View file