mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2026-01-08 13:58:08 +00:00
c958e86e9c
It's possible that mtk_crtc->event is NULL in
mtk_drm_crtc_finish_page_flip().
pending_needs_vblank value is set by mtk_crtc->event, but in
mtk_drm_crtc_atomic_flush(), it's is not guarded by the same
lock in mtk_drm_finish_page_flip(), thus a race condition happens.
Consider the following case:
CPU1 CPU2
step 1:
mtk_drm_crtc_atomic_begin()
mtk_crtc->event is not null,
step 1:
mtk_drm_crtc_atomic_flush:
mtk_drm_crtc_update_config(
!!mtk_crtc->event)
step 2:
mtk_crtc_ddp_irq ->
mtk_drm_finish_page_flip:
lock
mtk_crtc->event set to null,
pending_needs_vblank set to false
unlock
pending_needs_vblank set to true,
step 2:
mtk_crtc_ddp_irq ->
mtk_drm_finish_page_flip called again,
pending_needs_vblank is still true
//null pointer
Instead of guarding the entire mtk_drm_crtc_atomic_flush(), it's more
efficient to just check if mtk_crtc->event is null before use.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| mtk_cec.c | ||
| mtk_cec.h | ||
| mtk_disp_aal.c | ||
| mtk_disp_ccorr.c | ||
| mtk_disp_color.c | ||
| mtk_disp_drv.h | ||
| mtk_disp_gamma.c | ||
| mtk_disp_merge.c | ||
| mtk_disp_ovl_adaptor.c | ||
| mtk_disp_ovl.c | ||
| mtk_disp_rdma.c | ||
| mtk_dp_reg.h | ||
| mtk_dp.c | ||
| mtk_dpi_regs.h | ||
| mtk_dpi.c | ||
| mtk_drm_crtc.c | ||
| mtk_drm_crtc.h | ||
| mtk_drm_ddp_comp.c | ||
| mtk_drm_ddp_comp.h | ||
| mtk_drm_drv.c | ||
| mtk_drm_drv.h | ||
| mtk_drm_gem.c | ||
| mtk_drm_gem.h | ||
| mtk_drm_plane.c | ||
| mtk_drm_plane.h | ||
| mtk_dsi.c | ||
| mtk_ethdr.c | ||
| mtk_ethdr.h | ||
| mtk_hdmi_ddc.c | ||
| mtk_hdmi_regs.h | ||
| mtk_hdmi.c | ||
| mtk_hdmi.h | ||
| mtk_mdp_rdma.c | ||
| mtk_mdp_rdma.h | ||
| mtk_padding.c | ||