[Intel-gfx] [PATCH] drm/i915: Fix locking in DRRS flush/invalidate hooks

[Daniel Vetter]

We must acquire the mutex before we can check drrs.dp, otherwise
someone might sneak in with a modeset, clear the pointer after we've
checked it and then the code will Oops.

This issue has been introduced in

commit a93fad0f7fb8a3ff12e8814b630648f6d187954c
Author: Vandana Kannan <vandana.kannan at intel.com>
Date:   Sat Jan 10 02:25:59 2015 +0530

    drm/i915: DRRS calls based on frontbuffer

Cc: Ramalingam C <ramalingam.c at intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi at intel.com>
Cc: Vandana Kannan <vandana.kannan at intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
---
 drivers/gpu/drm/i915/intel_dp.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1b87969536ff..e265a0dee479 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -5170,7 +5170,6 @@ static void intel_edp_drrs_downclock_work(struct work_struct *work)
 			downclock_mode->vrefresh);
 
 unlock:
-
 	mutex_unlock(&dev_priv->drrs.mutex);
 }
 
@@ -5192,12 +5191,14 @@ void intel_edp_drrs_invalidate(struct drm_device *dev,
 	struct drm_crtc *crtc;
 	enum pipe pipe;
 
-	if (!dev_priv->drrs.dp)
-		return;
-
 	cancel_delayed_work_sync(&dev_priv->drrs.work);
 
 	mutex_lock(&dev_priv->drrs.mutex);
+	if (!dev_priv->drrs.dp) {
+		mutex_unlock(&dev_priv->drrs.mutex);
+		return;
+	}
+
 	crtc = dp_to_dig_port(dev_priv->drrs.dp)->base.base.crtc;
 	pipe = to_intel_crtc(crtc)->pipe;
 
@@ -5231,12 +5232,14 @@ void intel_edp_drrs_flush(struct drm_device *dev,
 	struct drm_crtc *crtc;
 	enum pipe pipe;
 
-	if (!dev_priv->drrs.dp)
-		return;
-
 	cancel_delayed_work_sync(&dev_priv->drrs.work);
 
 	mutex_lock(&dev_priv->drrs.mutex);
+	if (!dev_priv->drrs.dp) {
+		mutex_unlock(&dev_priv->drrs.mutex);
+		return;
+	}
+
 	crtc = dp_to_dig_port(dev_priv->drrs.dp)->base.base.crtc;
 	pipe = to_intel_crtc(crtc)->pipe;
 	dev_priv->drrs.busy_frontbuffer_bits &= ~frontbuffer_bits;
-- 
2.1.4