[PATCH 15/17] drm/tegra: Fix potential bug on driver unload

[Thierry Reding]

On Tue, Nov 04, 2014 at 11:59:46AM +0100, Andrzej Hajda wrote:
> Hi Thierry,
> 
> Just passing by.
> 
> On 11/03/2014 10:27 AM, Thierry Reding wrote:
> > From: Thierry Reding 
> > 
> > The HDMI hotplug signal may toggle after the DRM driver has been
> > unloaded. Make sure not to call into DRM if that's the case.
> > 
> > Signed-off-by: Thierry Reding 
> > ---
> >  drivers/gpu/drm/tegra/output.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
> > index 6b393cfbb5e7..def74914dd72 100644
> > --- a/drivers/gpu/drm/tegra/output.c
> > +++ b/drivers/gpu/drm/tegra/output.c
> > @@ -181,7 +181,8 @@ static irqreturn_t hpd_irq(int irq, void *data)
> >  {
> > struct tegra_output *output = data;
> >  
> > -   drm_helper_hpd_irq_event(output->connector.dev);
> > +   if (output->connector.dev)
> > +   drm_helper_hpd_irq_event(output->connector.dev);
> >  
> > return IRQ_HANDLED;
> >  }
> > 
> 
> Since output->connector.dev is not synchronized between irq and other
> code this patch do not solves the issue, it just decreases chances of
> the disaster.

You're right. I guess in addition to this we could call enable_irq()
when the connector is bound to the DRM device and disable_irq() when it
is unbound. Actually, that should even allow drm_helper_hpd_irq_event()
to be called unconditionally because .dev could not be NULL in that
case.

Upon closer inspection it seems like the majority of drivers would fall
prey to this particular race.

Thierry
-- next part --
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: 

[PATCH 15/17] drm/tegra: Fix potential bug on driver unload

[Andrzej Hajda]

Hi Thierry,

Just passing by.

On 11/03/2014 10:27 AM, Thierry Reding wrote:
> From: Thierry Reding 
> 
> The HDMI hotplug signal may toggle after the DRM driver has been
> unloaded. Make sure not to call into DRM if that's the case.
> 
> Signed-off-by: Thierry Reding 
> ---
>  drivers/gpu/drm/tegra/output.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
> index 6b393cfbb5e7..def74914dd72 100644
> --- a/drivers/gpu/drm/tegra/output.c
> +++ b/drivers/gpu/drm/tegra/output.c
> @@ -181,7 +181,8 @@ static irqreturn_t hpd_irq(int irq, void *data)
>  {
>   struct tegra_output *output = data;
>  
> - drm_helper_hpd_irq_event(output->connector.dev);
> + if (output->connector.dev)
> + drm_helper_hpd_irq_event(output->connector.dev);
>  
>   return IRQ_HANDLED;
>  }
> 

Since output->connector.dev is not synchronized between irq and other
code this patch do not solves the issue, it just decreases chances of
the disaster.

Regards
Andrzej

[PATCH 15/17] drm/tegra: Fix potential bug on driver unload

[Thierry Reding]

From: Thierry Reding 

The HDMI hotplug signal may toggle after the DRM driver has been
unloaded. Make sure not to call into DRM if that's the case.

Signed-off-by: Thierry Reding 
---
 drivers/gpu/drm/tegra/output.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
index 6b393cfbb5e7..def74914dd72 100644
--- a/drivers/gpu/drm/tegra/output.c
+++ b/drivers/gpu/drm/tegra/output.c
@@ -181,7 +181,8 @@ static irqreturn_t hpd_irq(int irq, void *data)
 {
struct tegra_output *output = data;

-   drm_helper_hpd_irq_event(output->connector.dev);
+   if (output->connector.dev)
+   drm_helper_hpd_irq_event(output->connector.dev);

return IRQ_HANDLED;
 }
-- 
2.1.2