[RFC] drm/exynos: abort commit when framebuffer is removed from plane

[Inki Dae]

2014-06-20 0:13 GMT+09:00 Rahul Sharma <rahul.sharma at samsung.com>:
> This situation arises when userspace remove the frambuffer object
> and call setmode ioctl.
>
> drm_mode_rmfb --> drm_plane_force_disable --> plane->crtc = NULL;
> and
> drm_mode_setcrtc --> exynos_plane_commit --> passes plane->crtc to
> exynos_drm_crtc_plane_commit which is NULL.

If user process requested drm_mode_rmfb with a fb_id, fb object to the
fb_id must be removed from crtc_idr table. So drm_mode_setcrtc should
be failed because there is no the fb object in the crtc_idr table
anymore.
I cannot understand how exynos_drm_crtc_plane_commit function could be
called. Can you give me more details?

Thanks,
Inki Dae

>
> This crashes the system.
>
> Signed-off-by: Rahul Sharma <rahul.sharma at samsung.com>
> ---
> This works fine but I am not confident on the correctness of the
> solution.
>
>  drivers/gpu/drm/exynos/exynos_drm_crtc.c |    6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
> index 95c9435..da4efe4 100644
> --- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
> +++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
> @@ -165,6 +165,12 @@ static int exynos_drm_crtc_mode_set_commit(struct drm_crtc *crtc, int x, int y,
>                 return -EPERM;
>         }
>
> +       /* when framebuffer is removed, commit should not proceed. */
> +       if(!plane->fb){
> +               DRM_ERROR("framebuffer has been removed from plane.\n");
> +               return -EFAULT;
> +       }
> +
>         crtc_w = crtc->primary->fb->width - x;
>         crtc_h = crtc->primary->fb->height - y;
>
> --
> 1.7.9.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-samsung-soc" in
> the body of a message to majordomo at vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html