drm/fbdev: Update legacy plane->fb refcounting for atomic restore
authorMatt Roper <matthew.d.roper@intel.com>
Tue, 22 Sep 2015 00:21:48 +0000 (17:21 -0700)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Thu, 24 Sep 2015 18:14:20 +0000 (20:14 +0200)
commit942840371cde152fe57c15e0e8483b760e7763e3
tree5a393f5aa986a7adb0538af21be08d4a7e26f411
parent5e7d49446b5964d2866ea1912cc9f65ab33ed76f
drm/fbdev: Update legacy plane->fb refcounting for atomic restore

Starting with commit

        commit 28cc504e8d52248962f5b485bdc65f539e3fe21d
        Author: Rob Clark <robdclark@gmail.com>
        Date:   Tue Aug 25 15:36:00 2015 -0400

            drm/i915: enable atomic fb-helper

I've been seeing some panics on i915 when the DRM master shuts down that appear
to be caused by using an already-freed framebuffer (i.e., we're unexpectedly
dropping our initial FB's reference count to 0 and freeing it, which causes a
crash when we try to restore it later).  Digging deeper, the state FB
refcounting is working as expected, but we seem to be missing proper
refcounting on the legacy plane->fb pointers in the new atomic fbdev code.

Tracking plane->old_fb and then doing a ref/unref at the end of the
fbdev restore like we do in the legacy ioctl's ensures we don't miscount
references on plane->fb and avoids the panics.

v2 from Daniel:

Really do what the atomic ioctl does:
- Also update plane->fb and plane->crtc.
- Clear out plane->old_fb on failures too.

v3: git add everything. Oops.

v4: Also clear old_fb in all other failure paths, spotted by David.

Cc: Rob Clark <robdclark@gmail.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: David Herrmann <dh.herrmann@gmail.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (v1)
Reviewd-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
drivers/gpu/drm/drm_fb_helper.c