From b3e067c0b276197b59046d7095b01b99f98b2821 Mon Sep 17 00:00:00 2001
From: Marcin Slusarz <marcin.slusarz@gmail.com>
Date: Wed, 9 Nov 2011 22:20:35 +0100
Subject: drm: serialize access to list of debugfs files
Git-commit: b3e067c0b276197b59046d7095b01b99f98b2821
Patch-mainline: v3.2-rc2

Nouveau, when configured with debugfs, creates debugfs files for every
channel, so structure holding list of files needs to be protected from
simultaneous changes by multiple threads.

Without this patch it's possible to hit kernel oops in
drm_debugfs_remove_files just by running a couple of xterms with
looped glxinfo.

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Acked-by: Michal Srb <msrb@suse.com>
---
 drivers/gpu/drm/drm_debugfs.c       |   12 +++++++++---
 drivers/gpu/drm/i915/i915_debugfs.c |    5 ++++-
 include/drm/drmP.h                  |    4 +++-
 3 files changed, 16 insertions(+), 5 deletions(-)

Index: linux-3.0-SLE11-SP3/drivers/gpu/drm/drm_debugfs.c
===================================================================
--- linux-3.0-SLE11-SP3.orig/drivers/gpu/drm/drm_debugfs.c
+++ linux-3.0-SLE11-SP3/drivers/gpu/drm/drm_debugfs.c
@@ -118,7 +118,10 @@ int drm_debugfs_create_files(struct drm_
 		tmp->minor = minor;
 		tmp->dent = ent;
 		tmp->info_ent = &files[i];
-		list_add(&(tmp->list), &(minor->debugfs_nodes.list));
+
+		mutex_lock(&minor->debugfs_lock);
+		list_add(&tmp->list, &minor->debugfs_list);
+		mutex_unlock(&minor->debugfs_lock);
 	}
 	return 0;
 
@@ -146,7 +149,8 @@ int drm_debugfs_init(struct drm_minor *m
 	char name[64];
 	int ret;
 
-	INIT_LIST_HEAD(&minor->debugfs_nodes.list);
+	INIT_LIST_HEAD(&minor->debugfs_list);
+	mutex_init(&minor->debugfs_lock);
 	sprintf(name, "%d", minor_id);
 	minor->debugfs_root = debugfs_create_dir(name, root);
 	if (!minor->debugfs_root) {
@@ -192,8 +196,9 @@ int drm_debugfs_remove_files(struct drm_
 	struct drm_info_node *tmp;
 	int i;
 
+	mutex_lock(&minor->debugfs_lock);
 	for (i = 0; i < count; i++) {
-		list_for_each_safe(pos, q, &minor->debugfs_nodes.list) {
+		list_for_each_safe(pos, q, &minor->debugfs_list) {
 			tmp = list_entry(pos, struct drm_info_node, list);
 			if (tmp->info_ent == &files[i]) {
 				debugfs_remove(tmp->dent);
@@ -202,6 +207,7 @@ int drm_debugfs_remove_files(struct drm_
 			}
 		}
 	}
+	mutex_unlock(&minor->debugfs_lock);
 	return 0;
 }
 EXPORT_SYMBOL(drm_debugfs_remove_files);
Index: linux-3.0-SLE11-SP3/drivers/gpu/drm/i915/i915_debugfs.c
===================================================================
--- linux-3.0-SLE11-SP3.orig/drivers/gpu/drm/i915/i915_debugfs.c
+++ linux-3.0-SLE11-SP3/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1555,7 +1555,10 @@ drm_add_fake_info_node(struct drm_minor
 	node->minor = minor;
 	node->dent = ent;
 	node->info_ent = (void *) key;
-	list_add(&node->list, &minor->debugfs_nodes.list);
+
+	mutex_lock(&minor->debugfs_lock);
+	list_add(&node->list, &minor->debugfs_list);
+	mutex_unlock(&minor->debugfs_lock);
 
 	return 0;
 }
Index: linux-3.0-SLE11-SP3/include/drm/drmP.h
===================================================================
--- linux-3.0-SLE11-SP3.orig/include/drm/drmP.h
+++ linux-3.0-SLE11-SP3/include/drm/drmP.h
@@ -990,7 +990,9 @@ struct drm_minor {
 	struct proc_dir_entry *proc_root;  /**< proc directory entry */
 	struct drm_info_node proc_nodes;
 	struct dentry *debugfs_root;
-	struct drm_info_node debugfs_nodes;
+
+	struct list_head debugfs_list;
+	struct mutex debugfs_lock; /* Protects debugfs_list. */
 
 	struct drm_master *master; /* currently active master for this node */
 	struct list_head master_list;
