2014-06-20 0:13 GMT+09:00 Rahul Sharma <rahul.sharma@xxxxxxxxxxx>: > This situation arises when userspace remove the frambuffer object > and call setmode ioctl. > > drm_mode_rmfb --> drm_plane_force_disable --> plane->crtc = NULL; > and > drm_mode_setcrtc --> exynos_plane_commit --> passes plane->crtc to > exynos_drm_crtc_plane_commit which is NULL. If user process requested drm_mode_rmfb with a fb_id, fb object to the fb_id must be removed from crtc_idr table. So drm_mode_setcrtc should be failed because there is no the fb object in the crtc_idr table anymore. I cannot understand how exynos_drm_crtc_plane_commit function could be called. Can you give me more details? Thanks, Inki Dae > > This crashes the system. > > Signed-off-by: Rahul Sharma <rahul.sharma@xxxxxxxxxxx> > --- > This works fine but I am not confident on the correctness of the > solution. > > drivers/gpu/drm/exynos/exynos_drm_crtc.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c > index 95c9435..da4efe4 100644 > --- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c > +++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c > @@ -165,6 +165,12 @@ static int exynos_drm_crtc_mode_set_commit(struct drm_crtc *crtc, int x, int y, > return -EPERM; > } > > + /* when framebuffer is removed, commit should not proceed. */ > + if(!plane->fb){ > + DRM_ERROR("framebuffer has been removed from plane.\n"); > + return -EFAULT; > + } > + > crtc_w = crtc->primary->fb->width - x; > crtc_h = crtc->primary->fb->height - y; > > -- > 1.7.9.5 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-samsung-soc" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-samsung-soc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html