In
commit bbb1e52402b2a288b09ae37e8182599931c7e9df
Author: Rob Clark <robdclark@xxxxxxxxx>
Date: Tue Aug 25 15:35:58 2015 -0400
drm/fb-helper: atomic restore_fbdev_mode()..
we've forgotten to do the plane->old_fb refcount dance for
pan_display_atomic, which can result in refcount leaks if the current
configuration is not from fbcon. Which apparently can happen when
vt-switching - fbcon does a pan first before a set_par.
OCD-align function parameters while at it.
v2: Actually git add the OCD.
Cc: Rob Clark <robdclark@xxxxxxxxx>
Cc: Rodrigo Vivi <rodrigo.vivi@xxxxxxxxx>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92483
Signed-off-by: Daniel Vetter <daniel.vetter@xxxxxxxxx>
---
drivers/gpu/drm/drm_fb_helper.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 0ac0fcc9b0d2..e673c13c7391 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1231,7 +1231,7 @@ int drm_fb_helper_set_par(struct fb_info *info)
EXPORT_SYMBOL(drm_fb_helper_set_par);
static int pan_display_atomic(struct fb_var_screeninfo *var,
- struct fb_info *info)
+ struct fb_info *info)
{
struct drm_fb_helper *fb_helper = info->par;
struct drm_device *dev = fb_helper->dev;
@@ -1249,6 +1249,8 @@ retry:
mode_set = &fb_helper->crtc_info[i].mode_set;
+ mode_set->crtc->primary->old_fb = mode_set->crtc->primary->fb;
+
mode_set->x = var->xoffset;
mode_set->y = var->yoffset;
@@ -1264,13 +1266,34 @@ retry:
info->var.xoffset = var->xoffset;
info->var.yoffset = var->yoffset;
- return 0;
fail:
+ for(i = 0; i < fb_helper->crtc_count; i++) {
+ struct drm_mode_set *mode_set;
+ struct drm_plane *plane;
+
+ mode_set = &fb_helper->crtc_info[i].mode_set;
+ plane = mode_set->crtc->primary;
+
+ if (ret == 0) {
+ struct drm_framebuffer *new_fb = plane->state->fb;
+
+ if (new_fb)
+ drm_framebuffer_reference(new_fb);
+ plane->fb = new_fb;
+ plane->crtc = plane->state->crtc;
+
+ if (plane->old_fb)
+ drm_framebuffer_unreference(plane->old_fb);
+ }
+ plane->old_fb = NULL;
+ }
+
if (ret == -EDEADLK)
goto backoff;
- drm_atomic_state_free(state);
+ if (ret != 0)
+ drm_atomic_state_free(state);
return ret;
--
2.5.1
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel
