From: Mario Kleiner Date: Wed, 6 Aug 2014 01:22:46 +0000 (+0200) Subject: drm: Use vblank_disable_and_save in drm_vblank_cleanup() X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=2368ffb18b1d2b04eb80478d225676caa7a3c4c8;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git drm: Use vblank_disable_and_save in drm_vblank_cleanup() Calling vblank_disable_fn() will cause that function to no-op if !dev->vblank_disable_allowed for some kms drivers, e.g., on nouveau-kms. This can cause the gpu vblank irq's to not get disabled before freeing the dev->vblank array, so if a vblank irq fires and calls into drm_handle_vblank() after drm_vblank_cleanup() completes, it will cause use-after-free access to dev->vblank array. Call vblank_disable_and_save unconditionally, so vblank irqs are guaranteed to be off, before we delete the data structures on which they operate. Signed-off-by: Mario Kleiner Reviewed-by: Ville Syrjälä [danvet: Fix subsystem name in patch subject.] Signed-off-by: Daniel Vetter --- diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c index 6473089e5fd3..9be760145cb7 100644 --- a/drivers/gpu/drm/drm_irq.c +++ b/drivers/gpu/drm/drm_irq.c @@ -239,6 +239,7 @@ static void vblank_disable_fn(unsigned long arg) void drm_vblank_cleanup(struct drm_device *dev) { int crtc; + unsigned long irqflags; /* Bail if the driver didn't call drm_vblank_init() */ if (dev->num_crtcs == 0) @@ -248,7 +249,10 @@ void drm_vblank_cleanup(struct drm_device *dev) struct drm_vblank_crtc *vblank = &dev->vblank[crtc]; del_timer_sync(&vblank->disable_timer); - vblank_disable_fn((unsigned long)vblank); + + spin_lock_irqsave(&dev->vbl_lock, irqflags); + vblank_disable_and_save(dev, crtc); + spin_unlock_irqrestore(&dev->vbl_lock, irqflags); } kfree(dev->vblank);