mirror of
https://github.com/torvalds/linux.git
synced 2024-09-20 06:53:04 +00:00
drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()
dc_state_destruct() nulls the resource context of the DC state. The pipe
context passed to dcn10_set_drr() is a member of this resource context.
If dc_state_destruct() is called parallel to the IRQ processing (which
calls dcn10_set_drr() at some point), we can end up using already nulled
function callback fields of struct stream_resource.
The logic in dcn10_set_drr() already tries to avoid this, by checking tg
against NULL. But if the nulling happens exactly after the NULL check and
before the next access, then we get a race.
Avoid this by copying tg first to a local variable, and then use this
variable for all the operations. This should work, as long as nobody
frees the resource pool where the timing generators live.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3142
Fixes: 06ad7e1642
("drm/amd/display: Destroy DC context while keeping DML and DML2")
Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
Tested-by: Raoul van Rüschen <raoul.van.rueschen@gmail.com>
Tested-by: Christopher Snowhill <chris@kode54.net>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Tested-by: Sefa Eyeoglu <contact@scrumplex.net>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
parent
760e3c8b32
commit
a3cc326a43
|
@ -3212,15 +3212,19 @@ void dcn10_set_drr(struct pipe_ctx **pipe_ctx,
|
|||
* as well.
|
||||
*/
|
||||
for (i = 0; i < num_pipes; i++) {
|
||||
if ((pipe_ctx[i]->stream_res.tg != NULL) && pipe_ctx[i]->stream_res.tg->funcs) {
|
||||
if (pipe_ctx[i]->stream_res.tg->funcs->set_drr)
|
||||
pipe_ctx[i]->stream_res.tg->funcs->set_drr(
|
||||
pipe_ctx[i]->stream_res.tg, ¶ms);
|
||||
/* dc_state_destruct() might null the stream resources, so fetch tg
|
||||
* here first to avoid a race condition. The lifetime of the pointee
|
||||
* itself (the timing_generator object) is not a problem here.
|
||||
*/
|
||||
struct timing_generator *tg = pipe_ctx[i]->stream_res.tg;
|
||||
|
||||
if ((tg != NULL) && tg->funcs) {
|
||||
if (tg->funcs->set_drr)
|
||||
tg->funcs->set_drr(tg, ¶ms);
|
||||
if (adjust.v_total_max != 0 && adjust.v_total_min != 0)
|
||||
if (pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control)
|
||||
pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control(
|
||||
pipe_ctx[i]->stream_res.tg,
|
||||
event_triggers, num_frames);
|
||||
if (tg->funcs->set_static_screen_control)
|
||||
tg->funcs->set_static_screen_control(
|
||||
tg, event_triggers, num_frames);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user