When there are unconsumed pending events, the events are destroyed by calling destroy callback, but the events list are remained, because there is no list_del().
It is possible that the page flip request is handled after drm_events_release() is called and before drm_fb_release(). In this case a drm_pending_event is remained not freed. So exynos driver checks again to remove it in its post close routine. But the file_priv->event_list contains undeleted ones, this can make oops for accessing invalid memory.
Change-Id: I2eaad659d5b514d5df68a2323083dbd38ada1b5f Signed-off-by: YoungJun Cho yj44.cho@samsung.com Signed-off-by: Kyungmin Park kyungmin.park@samsung.com --- drivers/gpu/drm/drm_fops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c index 3f84277..3c860b7 100644 --- a/drivers/gpu/drm/drm_fops.c +++ b/drivers/gpu/drm/drm_fops.c @@ -379,8 +379,10 @@ static void drm_events_release(struct drm_file *file_priv) }
/* Remove unconsumed events */ - list_for_each_entry_safe(e, et, &file_priv->event_list, link) + list_for_each_entry_safe(e, et, &file_priv->event_list, link) { + list_del(&e->link); e->destroy(e); + }
spin_unlock_irqrestore(&dev->event_lock, flags); }