Patch "drm/mediatek: Fix iommu fault by swapping FBs after updating plane state" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/mediatek: Fix iommu fault by swapping FBs after updating plane state

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-mediatek-fix-iommu-fault-by-swapping-fbs-after-u.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 61b1471f1681c392ead9e8516f865c36748d38ec
Author: Jason-JH.Lin <jason-jh.lin@xxxxxxxxxxxx>
Date:   Wed Aug 9 20:57:21 2023 +0800

    drm/mediatek: Fix iommu fault by swapping FBs after updating plane state
    
    [ Upstream commit 3ec71e05ae6e7f46512e568ed81c92be589003dd ]
    
    According to the comment in drm_atomic_helper_async_commit(),
    we should make sure FBs have been swapped, so that cleanups in the
    new_state performs a cleanup in the old FB.
    
    So we should move swapping FBs after calling mtk_plane_update_new_state(),
    to avoid using the old FB which could be freed.
    
    Fixes: 1a64a7aff8da ("drm/mediatek: Fix cursor plane no update")
    Signed-off-by: Jason-JH.Lin <jason-jh.lin@xxxxxxxxxxxx>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@xxxxxxxxxxxxx>
    Reviewed-by: CK Hu <ck.hu@xxxxxxxxxxxx>
    Reviewed-by: Alexandre Mergnat <amergnat@xxxxxxxxxxxx>
    Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230809125722.24112-2-jason-jh.lin@xxxxxxxxxxxx/
    Signed-off-by: Chun-Kuang Hu <chunkuang.hu@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_plane.c b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
index 734a1fb052dfd..eda072a3bf9ae 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_plane.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
@@ -154,9 +154,9 @@ static void mtk_plane_atomic_async_update(struct drm_plane *plane,
 	plane->state->src_y = new_state->src_y;
 	plane->state->src_h = new_state->src_h;
 	plane->state->src_w = new_state->src_w;
-	swap(plane->state->fb, new_state->fb);
 
 	mtk_plane_update_new_state(new_state, new_plane_state);
+	swap(plane->state->fb, new_state->fb);
 	wmb(); /* Make sure the above parameters are set before update */
 	new_plane_state->pending.async_dirty = true;
 	mtk_drm_crtc_async_update(new_state->crtc, plane, state);