[PATCH] drm/exynos: fix cancel page flip code

[Daniel Stone]

Hi Andrzej,

On 24 March 2016 at 10:52, Andrzej Hajda <a.hajda at samsung.com> wrote:
> @@ -229,24 +229,12 @@ void exynos_drm_crtc_cancel_page_flip(struct drm_crtc *crtc,
>                                         struct drm_file *file)
>  {
>         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
> -       struct drm_pending_vblank_event *e;
> -       unsigned long flags;
> +       struct drm_pending_vblank_event *e = exynos_crtc->event;
>
> -       spin_lock_irqsave(&crtc->dev->event_lock, flags);
> -       e = exynos_crtc->event;
> -       if (e && e->base.file_priv == file) {
> -               exynos_crtc->event = NULL;
> -               /*
> -                * event will be destroyed by core part
> -                * so below line should be removed later with core changes
> -                */
> -               e->base.destroy(&e->base);
> -               /*
> -                * event_space will be increased by core part
> -                * so below line should be removed later with core changes.
> -                */
> -               file->event_space += sizeof(e->event);
> -               atomic_dec(&exynos_crtc->pending_update);
> -       }
> -       spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
> +       if (!e || e->base.file_priv != file)
> +               return;
> +
> +       exynos_crtc->event = NULL;
> +       atomic_dec(&exynos_crtc->pending_update);
> +       drm_event_cancel_free(crtc->dev, &e->base);

Accessing and manipulating exynos_crtc->event should still be done
under event_lock, to avoid racing with the IRQ handler.

Cheers,
Daniel