drm: Use vblank_disable_and_save in drm_vblank_cleanup()
authorMario Kleiner <mario.kleiner.de@gmail.com>
Wed, 6 Aug 2014 01:22:46 +0000 (03:22 +0200)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Wed, 10 Sep 2014 07:41:29 +0000 (09:41 +0200)
commit2368ffb18b1d2b04eb80478d225676caa7a3c4c8
treedf045778d0c44fb8d4d729fce32e3d0fcda4c771
parent79a093aea44f11fda0a5b4dbe4c1e29b2f586f4e
drm: Use vblank_disable_and_save in drm_vblank_cleanup()

Calling vblank_disable_fn() will cause that function to no-op
if !dev->vblank_disable_allowed for some kms drivers, e.g.,
on nouveau-kms. This can cause the gpu vblank irq's to not get
disabled before freeing the dev->vblank array, so if a
vblank irq fires and calls into drm_handle_vblank() after
drm_vblank_cleanup() completes, it will cause use-after-free
access to dev->vblank array.

Call vblank_disable_and_save unconditionally, so vblank irqs
are guaranteed to be off, before we delete the data structures
on which they operate.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
[danvet: Fix subsystem name in patch subject.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
drivers/gpu/drm/drm_irq.c