From a0fb6ad7ae28a4dce34c010028dc070eeacae1d9 Mon Sep 17 00:00:00 2001 From: Daniel Vetter Date: Fri, 16 Oct 2015 19:11:30 +0200 Subject: [PATCH] drm/fb-helper: Fix fb refcounting in pan_display_atomic In commit bbb1e52402b2a288b09ae37e8182599931c7e9df Author: Rob Clark Date: Tue Aug 25 15:35:58 2015 -0400 drm/fb-helper: atomic restore_fbdev_mode().. we've forgotten to do the plane->old_fb refcount dance for pan_display_atomic, which can result in refcount leaks if the current configuration is not from fbcon. Which apparently can happen when vt-switching - fbcon does a pan first before a set_par. OCD-align function parameters while at it. v2: Actually git add the OCD. Cc: Rob Clark Cc: Rodrigo Vivi Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92483 Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1445015490-27682-1-git-send-email-daniel.vetter@ffwll.ch Tested-by: Rodrigo Vivi Reviewed-by: Rob Clark Signed-off-by: Daniel Vetter --- drivers/gpu/drm/drm_fb_helper.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index 80e06316b520..5b2de1b3c020 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -1227,7 +1227,7 @@ int drm_fb_helper_set_par(struct fb_info *info) EXPORT_SYMBOL(drm_fb_helper_set_par); static int pan_display_atomic(struct fb_var_screeninfo *var, - struct fb_info *info) + struct fb_info *info) { struct drm_fb_helper *fb_helper = info->par; struct drm_device *dev = fb_helper->dev; @@ -1245,6 +1245,8 @@ retry: mode_set = &fb_helper->crtc_info[i].mode_set; + mode_set->crtc->primary->old_fb = mode_set->crtc->primary->fb; + mode_set->x = var->xoffset; mode_set->y = var->yoffset; @@ -1260,13 +1262,34 @@ retry: info->var.xoffset = var->xoffset; info->var.yoffset = var->yoffset; - return 0; fail: + for(i = 0; i < fb_helper->crtc_count; i++) { + struct drm_mode_set *mode_set; + struct drm_plane *plane; + + mode_set = &fb_helper->crtc_info[i].mode_set; + plane = mode_set->crtc->primary; + + if (ret == 0) { + struct drm_framebuffer *new_fb = plane->state->fb; + + if (new_fb) + drm_framebuffer_reference(new_fb); + plane->fb = new_fb; + plane->crtc = plane->state->crtc; + + if (plane->old_fb) + drm_framebuffer_unreference(plane->old_fb); + } + plane->old_fb = NULL; + } + if (ret == -EDEADLK) goto backoff; - drm_atomic_state_free(state); + if (ret != 0) + drm_atomic_state_free(state); return ret;