drm/nouveau/core: Allow asymmetric nouveau_event_get/_put

Most nouveau event handlers have storage in 'static' containers
(structures with lifetimes nearly equivalent to the drm_device),
but are dangerously reused via nouveau_event_get/_put. For
example, if nouveau_event_get is called more than once for a
given handler, the event handler list will be corrupted.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

diff --git a/drivers/gpu/drm/nouveau/core/core/event.c b/drivers/gpu/drm/nouveau/core/core/event.c
index e69c463e66e25540c16bbd67a87965d1261229ec..9393c37b71c9c1886460c99c0677501882fc8940 100644 (file)
--- a/drivers/gpu/drm/nouveau/core/core/event.c
+++ b/drivers/gpu/drm/nouveau/core/core/event.c
@@ -27,11 +27,13 @@ static void
 nouveau_event_put_locked(struct nouveau_event *event, int index,
                         struct nouveau_eventh *handler)
 {
-       if (!--event->index[index].refs) {
-               if (event->disable)
-                       event->disable(event, index);
+       if (__test_and_clear_bit(NVKM_EVENT_ENABLE, &handler->flags)) {
+               if (!--event->index[index].refs) {
+                       if (event->disable)
+                               event->disable(event, index);
+               }
+               list_del(&handler->head);
        }
-       list_del(&handler->head);
 }
 
 void
@@ -58,10 +60,12 @@ nouveau_event_get(struct nouveau_event *event, int index,
                return;
 
        spin_lock_irqsave(&event->lock, flags);
-       list_add(&handler->head, &event->index[index].list);
-       if (!event->index[index].refs++) {
-               if (event->enable)
-                       event->enable(event, index);
+       if (!__test_and_set_bit(NVKM_EVENT_ENABLE, &handler->flags)) {
+               list_add(&handler->head, &event->index[index].list);
+               if (!event->index[index].refs++) {
+                       if (event->enable)
+                               event->enable(event, index);
+               }
        }
        spin_unlock_irqrestore(&event->lock, flags);
 }

diff --git a/drivers/gpu/drm/nouveau/core/include/core/event.h b/drivers/gpu/drm/nouveau/core/include/core/event.h
index ad4d8c283d5fe330b137af7b30c5e274ba054636..cb2f632cb3a549ed87d39b6df58d71bb74125008 100644 (file)
--- a/drivers/gpu/drm/nouveau/core/include/core/event.h
+++ b/drivers/gpu/drm/nouveau/core/include/core/event.h
@@ -5,8 +5,12 @@
 #define NVKM_EVENT_DROP 0
 #define NVKM_EVENT_KEEP 1
 
+/* nouveau_eventh.flags bit #s */
+#define NVKM_EVENT_ENABLE 0
+
 struct nouveau_eventh {
        struct list_head head;
+       unsigned long flags;
        void *priv;
        int (*func)(struct nouveau_eventh *, int index);
 };

diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 20626b93130c1d62416f5ed8ac616ffa8c8db26b..42e30e256cdce647c9e40376ed593e807fd2797d 100644 (file)
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -95,7 +95,6 @@ nouveau_drm_vblank_enable(struct drm_device *dev, int head)
 
        if (WARN_ON_ONCE(head >= ARRAY_SIZE(drm->vblank)))
                return -EIO;
-       WARN_ON_ONCE(drm->vblank[head].func);
        drm->vblank[head].func = nouveau_drm_vblank_handler;
        nouveau_event_get(pdisp->vblank, head, &drm->vblank[head]);
        return 0;
@@ -106,11 +105,8 @@ nouveau_drm_vblank_disable(struct drm_device *dev, int head)
 {
        struct nouveau_drm *drm = nouveau_drm(dev);
        struct nouveau_disp *pdisp = nouveau_disp(drm->device);
-       if (drm->vblank[head].func)
-               nouveau_event_put(pdisp->vblank, head, &drm->vblank[head]);
-       else
-               WARN_ON_ONCE(1);
-       drm->vblank[head].func = NULL;
+
+       nouveau_event_put(pdisp->vblank, head, &drm->vblank[head]);
 }
 
 static u64