drm/gma500: Lock struct_mutex around cursor updates

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64361
Cc: <stable@vger.kernel.org>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>

diff --git a/drivers/gpu/drm/gma500/gma_display.c b/drivers/gpu/drm/gma500/gma_display.c
index 24e8af3..386de2c 100644 (file)
--- a/drivers/gpu/drm/gma500/gma_display.c
+++ b/drivers/gpu/drm/gma500/gma_display.c
@@ -349,6 +349,7 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
        /* If we didn't get a handle then turn the cursor off */
        if (!handle) {
                temp = CURSOR_MODE_DISABLE;
+               mutex_lock(&dev->struct_mutex);
 
                if (gma_power_begin(dev, false)) {
                        REG_WRITE(control, temp);
@@ -365,6 +366,7 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
                        gma_crtc->cursor_obj = NULL;
                }
 
+               mutex_unlock(&dev->struct_mutex);
                return 0;
        }
 
@@ -374,9 +376,12 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
                return -EINVAL;
        }
 
+       mutex_lock(&dev->struct_mutex);
        obj = drm_gem_object_lookup(dev, file_priv, handle);
-       if (!obj)
-               return -ENOENT;
+       if (!obj) {
+               ret = -ENOENT;
+               goto unlock;
+       }
 
        if (obj->size < width * height * 4) {
                dev_dbg(dev->dev, "Buffer is too small\n");
@@ -440,10 +445,13 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
        }
 
        gma_crtc->cursor_obj = obj;
+unlock:
+       mutex_unlock(&dev->struct_mutex);
        return ret;
 
 unref_cursor:
        drm_gem_object_unreference(obj);
+       mutex_unlock(&dev->struct_mutex);
        return ret;
 }