[Intel-gfx] [PATCH] drm/i915: hold ref on flip object until it completes

[Owain Ainsworth]

On Wed, Feb 10, 2010 at 02:55:56PM -0800, Jesse Barnes wrote:
> This will prevent things from falling over if the user frees the flip
> buffer before we complete the flip, since we'll hold an internal
> reference.
> 
> Reported-by: Kristian H??gsberg <krh at bitplanet.net>
> Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
> 
> diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> index 2476fb4..372a2f5 100644
> --- a/drivers/gpu/drm/i915/intel_display.c
> +++ b/drivers/gpu/drm/i915/intel_display.c
> @@ -4039,6 +4039,9 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
>  	    atomic_dec_and_test(&obj_priv->pending_flip))
>  		DRM_WAKEUP(&dev_priv->pending_flip_queue);
>  	schedule_work(&work->work);
> +
> +	/* Drop the flip ref we took when the ioctl was called */
> +	drm_gem_object_unreference(work->pending_flip_obj);
>  }

two problems:
1) not holdin struct mutex ((this is in interrupt context).
2) you're doing that from interrupt context. stuff like the unref, the
possible free and unbind should not happen here.

-0-
-- 
Lost interest?  It's so bad I've lost apathy.