drm: hold event_lock while accessing vblank_event_list

Currently the only users of drm_vblank_off() are i915 and gma500,
neither of which holds the event_lock when calling this function.
Fix this by holding the event_lock while traversing the list.

Signed-off-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 2ba9d7fac345..19c01ca3cc76 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -1021,6 +1021,8 @@ void drm_vblank_off(struct drm_device *dev, int crtc)
 
         /* Send any queued vblank events, lest the natives grow disquiet */
         seq = drm_vblank_count_and_time(dev, crtc, &now);
+
+        spin_lock(&dev->event_lock);
         list_for_each_entry_safe(e, t, &dev->vblank_event_list, base.link) {
                 if (e->pipe != crtc)
                         continue;
@@ -1031,6 +1033,7 @@ void drm_vblank_off(struct drm_device *dev, int crtc)
                 drm_vblank_put(dev, e->pipe);
                 send_vblank_event(dev, e, seq, &now);
         }
+        spin_unlock(&dev->event_lock);
 
         spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 }