drm/i915: Fix race on unreferencing the wrong mmio-flip-request

Browse source

As we perform the mmio-flip without any locking and then try to acquire
the struct_mutex prior to dereferencing the request, it is possible for
userspace to queue a new pageflip before the worker can finish clearing
the old state - and then it will clear the new flip request. The result
is that the new flip could be completed before the GPU has finished
rendering.

The bugs stems from removing the seqno checking in
commit 536f5b5e86
Author: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Date:   Thu Nov 6 11:03:40 2014 +0200

    drm/i915: Make mmio flip wait for seqno in the work function

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

...

This commit is contained in:

Chris Wilson 2015-04-27 13:41:16 +01:00 • committed by Daniel Vetter

parent d94b5030d2

commit b2cfe0ab63

3 changed files with 25 additions and 24 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

drivers/gpu/drm/i915/i915_drv.h

View file

39

drivers/gpu/drm/i915/intel_display.c

View file

4

drivers/gpu/drm/i915/intel_drv.h

View file