drm/i915: unload: fix hotplug_work races

hotplug_work is queued by the hotplug interrupt and only either emits
a hotplug uevent or queues a crt poll slow-work. No other locking.  So
it's safe to cancel this work _after_ irq's have been turned off.  But
before the modesetting objects are destroyed because the hotplug
function accesses them (without locking).

The current code (for kms) only switches irqs off after modesetting
teardown, hence move the irq teardown into the modeset cleanup right
before the crtc cleanup.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

2 files changed, 6 insertions, 1 deletions

diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 736cca8a03d4..45236e716669 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2275,7 +2275,7 @@ int i915_driver_unload(struct drm_device *dev)
                         dev_priv->child_dev = NULL;
                         dev_priv->child_dev_num = 0;
                 }
-                drm_irq_uninstall(dev);
+
                 vga_switcheroo_unregister_client(dev->pdev);
                 vga_client_register(dev->pdev, NULL, NULL, NULL);
         }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 7c9103030036..20be935830b0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6073,6 +6073,11 @@ void intel_modeset_cleanup(struct drm_device *dev)
 
         mutex_unlock(&dev->struct_mutex);
 
+        /* Disable the irq before mode object teardown, for the irq might
+         * enqueue unpin/hotplug work. */
+        drm_irq_uninstall(dev);
+        cancel_work_sync(&dev_priv->hotplug_work);
+
         drm_mode_config_cleanup(dev);
 }