71 lines
2.4 KiB
Diff
71 lines
2.4 KiB
Diff
|
From 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||
|
|
Date: Fri, 27 Feb 2015 12:58:13 +0100
|
||
|
|
Subject: drm: Fixup racy refcounting in plane_force_disable
|
||
|
|
|
||
|
|
Originally it was impossible to be dropping the last refcount in this
|
||
|
|
function since there was always one around still from the idr. But in
|
||
|
|
|
||
|
|
commit 83f45fc360c8e16a330474860ebda872d1384c8c
|
||
|
|
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||
|
|
Date: Wed Aug 6 09:10:18 2014 +0200
|
||
|
|
|
||
|
|
drm: Don't grab an fb reference for the idr
|
||
|
|
|
||
|
|
we've switched to weak references, broke that assumption but forgot to
|
||
|
|
fix it up.
|
||
|
|
|
||
|
|
Since we still force-disable planes it's only possible to hit this
|
||
|
|
when racing multiple rmfb with fbdev restoring or similar evil things.
|
||
|
|
As long as userspace is nice it's impossible to hit the BUG_ON.
|
||
|
|
|
||
|
|
But the BUG_ON would most likely be hit from fbdev code, which usually
|
||
|
|
invovles the console_lock besides all modeset locks. So very likely
|
||
|
|
we'd never get the bug reports if this was hit in the wild, hence
|
||
|
|
better be safe than sorry and backport.
|
||
|
|
|
||
|
|
Spotted by Matt Roper while reviewing other patches.
|
||
|
|
|
||
|
|
[airlied: pull this back into 4.0 - the oops happens there]
|
||
|
|
|
||
|
|
Cc: stable@vger.kernel.org
|
||
|
|
Cc: Matt Roper <matthew.d.roper@intel.com>
|
||
|
|
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
|
||
|
|
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
|
||
|
|
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
||
|
|
|
||
|
|
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
|
||
|
|
index f6d04c7..679b10e 100644
|
||
|
|
--- a/drivers/gpu/drm/drm_crtc.c
|
||
|
|
+++ b/drivers/gpu/drm/drm_crtc.c
|
||
|
|
@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
|
||
|
|
}
|
||
|
|
EXPORT_SYMBOL(drm_framebuffer_reference);
|
||
|
|
|
||
|
|
-static void drm_framebuffer_free_bug(struct kref *kref)
|
||
|
|
-{
|
||
|
|
- BUG();
|
||
|
|
-}
|
||
|
|
-
|
||
|
|
-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
|
||
|
|
-{
|
||
|
|
- DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
|
||
|
|
- kref_put(&fb->refcount, drm_framebuffer_free_bug);
|
||
|
|
-}
|
||
|
|
-
|
||
|
|
/**
|
||
|
|
* drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
|
||
|
|
* @fb: fb to unregister
|
||
|
|
@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
/* disconnect the plane from the fb and crtc: */
|
||
|
|
- __drm_framebuffer_unreference(plane->old_fb);
|
||
|
|
+ drm_framebuffer_unreference(plane->old_fb);
|
||
|
|
plane->old_fb = NULL;
|
||
|
|
plane->fb = NULL;
|
||
|
|
plane->crtc = NULL;
|
||
|
|
--
|
||
|
|
cgit v0.10.2
|
||
|
|
|