drm/i915: Add locking around framebuffer_references--

vsyrjala · danvet · commit 60a5ca015ffd · 2014-06-13T17:45:28.000+02:00
obj-&gt;framebuffer_references isn't an atomic_t so the decrement needs to
be protected by some lock. struct_mutex seems like the appropriate lock
here, and we may already take it for the obj unref anyway.

Signed-off-by: Ville Syrjälä &lt;ville.syrjala@linux.intel.com&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
@@ -11594,11 +11594,14 @@ static void intel_setup_outputs(struct drm_device *dev)
 
 static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
+	struct drm_device *dev = fb->dev;
 	struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
 
 	drm_framebuffer_cleanup(fb);
+	mutex_lock(&dev->struct_mutex);
 	WARN_ON(!intel_fb->obj->framebuffer_references--);
-	drm_gem_object_unreference_unlocked(&intel_fb->obj->base);
+	drm_gem_object_unreference(&intel_fb->obj->base);
+	mutex_unlock(&dev->struct_mutex);
 	kfree(intel_fb);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -11594,11 +11594,14 @@ static void intel_setup_outputs(struct drm_device *dev)`
`11594`	`11594`
`11595`	`11595`	`static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb)`
`11596`	`11596`	`{`
	`11597`	`+ struct drm_device *dev = fb->dev;`
`11597`	`11598`	`struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);`
`11598`	`11599`
`11599`	`11600`	`drm_framebuffer_cleanup(fb);`
	`11601`	`+ mutex_lock(&dev->struct_mutex);`
`11600`	`11602`	`WARN_ON(!intel_fb->obj->framebuffer_references--);`
`11601`		`- drm_gem_object_unreference_unlocked(&intel_fb->obj->base);`
	`11603`	`+ drm_gem_object_unreference(&intel_fb->obj->base);`
	`11604`	`+ mutex_unlock(&dev->struct_mutex);`
`11602`	`11605`	`kfree(intel_fb);`
`11603`	`11606`	`}`
`11604`	`11607`