The field obejct_idr of struct drm_via_private was introduced with the
commit  

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=77ee8f3825054f23b17e9c8f728f061defd86cdc
 .

In that patch idr_init(&dev->object_name_idr) was called instead of
idr_init(&dev_priv->object_idr) by mistake, leaving the dev_priv->object_idr
uninitialized. To be more exact, the object_idr buffer is filled with zeros
because of kzalloc(), but the dev_priv->object_idr.lock spinlock can cause
system freeze at lib/idr.c:move_to_free_list() when spin_lock_irqsave()
is called on this spinlock.

Signed-off-by: M?rton N?meth <nm127 at freemail.hu>
Signed-off-by: James Simmons <jsimmons at infradead.org>

diff --git a/drivers/gpu/drm/via/via_map.c b/drivers/gpu/drm/via/via_map.c
index 1f18225..240bc49 100644
--- a/drivers/gpu/drm/via/via_map.c
+++ b/drivers/gpu/drm/via/via_map.c
@@ -100,12 +100,10 @@ int via_driver_load(struct drm_device *dev, unsigned long 
chipset)
        if (dev_priv == NULL)
                return -ENOMEM;

+       idr_init(&dev_priv->object_idr);
        dev->dev_private = (void *)dev_priv;
-
        dev_priv->chipset = chipset;

-       idr_init(&dev->object_name_idr);
-
        pci_set_master(dev->pdev);

        ret = drm_vblank_init(dev, 1);

Reply via email to