On Fri, Jan 12, 2018 at 09:57:03PM +0000, Dhinakaran Pandiyan wrote:
drm_vblank_count() has a u32 type returning what is a 64-bit vblank count. The effect of this is when drm_wait_vblank_ioctl() tries to widen the user space requested vblank sequence using this clipped 32-bit count(when the value is >= 2^32) as reference, the requested sequence remains a 32-bit value and gets queued like that. However, the code that checks if the requested sequence has passed compares this against the 64-bit vblank count.
Worth to mention and probably Fixes: 570e86963a51 ("drm: Widen vblank count to 64-bits [v3]")
btw, I spotted at least one more place even with the series applied. 32 current_vblank; at drm_mode_page_flip_ioctl...
so, probably worth to do a deeper check down to all paths...
anayway, for this patch: Reviewed-by: Rodrigo Vivi rodrigo.vivi@intel.com
Cc: Keith Packard keithp@keithp.com Cc: Michel Dänzer michel@daenzer.net Cc: Daniel Vetter daniel@ffwll.ch Signed-off-by: Dhinakaran Pandiyan dhinakaran.pandiyan@intel.com
drivers/gpu/drm/drm_vblank.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c index 32d9bcf5be7f..768a8e44d99b 100644 --- a/drivers/gpu/drm/drm_vblank.c +++ b/drivers/gpu/drm/drm_vblank.c @@ -271,7 +271,7 @@ static void drm_update_vblank_count(struct drm_device *dev, unsigned int pipe, store_vblank(dev, pipe, diff, t_vblank, cur_vblank); }
-static u32 drm_vblank_count(struct drm_device *dev, unsigned int pipe) +static u64 drm_vblank_count(struct drm_device *dev, unsigned int pipe) { struct drm_vblank_crtc *vblank = &dev->vblank[pipe];
-- 2.11.0