From d43f41250b3628450e268f7d325c066e19c00a8b Mon Sep 17 00:00:00 2001
From: Michel Thierry <michel.thierry@intel.com>
Date: Tue, 12 May 2015 10:25:52 +0100
Subject: [PATCH] drm: Prevent null mutext_unlock

Added by commit 672cb1d6aec7da2799afd1b529d5136d84ed2561
Author: Daniel Stone <daniels@collabora.com>
Date:   Mon Apr 20 19:22:55 2015 +0100

    drm: Add reference counting to blob properties

    Reference-count drm_property_blob objects, changing the API to
    ref/unref.

    Signed-off-by: Daniel Stone <daniels@collabora.com>
    Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

[   17.436310] [drm:drm_helper_probe_single_connector_modes_merge_bits] [CONNECTOR:31:eDP-1] status updated from 3 to 1
[   17.436369] general protection fault: 0000 [#1] SMP
[   17.436408] Workqueue: events_unbound async_run_entry_fn
[   17.436410] task: ffff88014879cf50 ti: ffff880144754000 task.ti: ffff880144754000
[   17.436415] RIP: 0010:[<ffffffff817b6716>]  [<ffffffff817b6716>] mutex_unlock+0x6/0x20
[   17.436416] RSP: 0018:ffff880144757bd8  EFLAGS: 00010202
[   17.436417] RAX: 00000000001f0001 RBX: ffff88014541aaa8 RCX: 00000001001f001a
[   17.436418] RDX: 000000000000001f RSI: ffffea0005150600 RDI: 6b6b6b6b6b6b6fab
[   17.436419] RBP: ffff880144757bf8 R08: ffff88014541aaa8 R09: 00000001001f0019
[   17.436420] R10: ffff880145895178 R11: 000000000000000f R12: ffff8800a87d57c8
[   17.436421] R13: ffff88014541aaa8 R14: ffff8800a87d5388 R15: ffffffffa0398d90
[   17.436422] FS:  0000000000000000(0000) GS:ffff88014e480000(0000) knlGS:0000000000000000
[   17.436423] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   17.436424] CR2: 000056518ffbf098 CR3: 0000000035a25000 CR4: 00000000003407e0
[   17.436425] Stack:
[   17.436427]  ffff880144757bf8 ffffffffa01fe3be ffff8800a866b888 ffff88014541acb0
[   17.436429]  ffff880144757c48 ffffffffa01fe467 0000000000000000 ffff8800a87d5750
[   17.436431]  ffff880144546c88 ffff8800a866b7d8 ffff8800a866b7b0 ffff8800a77fe8f8
[   17.436432] Call Trace:
[   17.436448]  [<ffffffffa01fe3be>] ? drm_property_unreference_blob+0xbe/0xc0 [drm]
[   17.436460]  [<ffffffffa01fe467>] drm_property_replace_global_blob+0xa7/0x130 [drm]
[   17.436471]  [<ffffffffa01fe539>] drm_mode_connector_update_edid_property+0x49/0x50 [drm]
[   17.436508]  [<ffffffffa03554d4>] intel_connector_update_modes+0x24/0x50 [i915]
[   17.436539]  [<ffffffffa036d139>] intel_dp_get_modes+0x29/0x90 [i915]
[   17.436546]  [<ffffffffa02a7aeb>] drm_helper_probe_single_connector_modes_merge_bits+0xfb/0x4f0 [drm_kms_helper]
[   17.436551]  [<ffffffffa02a7f13>] drm_helper_probe_single_connector_modes+0x13/0x20 [drm_kms_helper]
[   17.436558]  [<ffffffffa02b2eaa>] drm_fb_helper_initial_config+0x7a/0x430 [drm_kms_helper]
[   17.436561]  [<ffffffff810aacdd>] ? vtime_common_task_switch+0x3d/0x50
[   17.436589]  [<ffffffffa035f23b>] intel_fbdev_initial_config+0x1b/0x20 [i915]
[   17.436591]  [<ffffffff8109af6c>] async_run_entry_fn+0x4c/0x160
[   17.436596]  [<ffffffff8109202d>] worker_thread+0x11d/0x540
[   17.436599]  [<ffffffff817b41bf>] ? __schedule+0x36f/0x9ca
[   17.436601]  [<ffffffff81091f10>] ? create_worker+0x1d0/0x1d0
[   17.436604]  [<ffffffff81098609>] kthread+0xc9/0xe0
[   17.436607]  [<ffffffff81098540>] ? flush_kthread_worker+0x90/0x90
[   17.436609]  [<ffffffff817b8fa2>] ret_from_fork+0x42/0x70
[   17.436612]  [<ffffffff81098540>] ? flush_kthread_worker+0x90/0x90
[   17.436636] RIP  [<ffffffff817b6716>] mutex_unlock+0x6/0x20
[   17.436637]  RSP <ffff880144757bd8>
[   17.436648] ---[ end trace 3d71b0d542ada905 ]---

Signed-off-by: Michel Thierry <michel.thierry@intel.com>
---
 drivers/gpu/drm/drm_crtc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index e3ee5de..62b36f8 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -4306,7 +4306,7 @@ void drm_property_unreference_blob(struct drm_property_blob *blob)

 	if (kref_put_mutex(&blob->refcount, drm_property_free_blob,
 			   &dev->mode_config.blob_lock))
-		mutex_unlock(&blob->dev->mode_config.blob_lock);
+		mutex_unlock(&dev->mode_config.blob_lock);
 	else
 		might_lock(&dev->mode_config.blob_lock);

--
2.4.0