On Fri, Oct 16, 2015 at 12:23 PM, Daniel Vetter <daniel.vetter at ffwll.ch> wrote: > In > > commit bbb1e52402b2a288b09ae37e8182599931c7e9df > Author: Rob Clark <robdclark at gmail.com> > Date: Tue Aug 25 15:35:58 2015 -0400 > > drm/fb-helper: atomic restore_fbdev_mode().. > > we've forgotten to do the plane->old_fb refcount dance for > pan_display_atomic, which can result in refcount leaks if the current > configuration is not from fbcon. Which apparently can happen when > vt-switching - fbcon does a pan first before a set_par.
oh, whoops > OCD-align function parameters while at it. did you mean to drop that line from the commit msg, or include an extra hunk that you missed? at any rate, Reviewed-by: Rob Clark <robdclark at gmail.com> > Cc: Rob Clark <robdclark at gmail.com> > Cc: Rodrigo Vivi <rodrigo.vivi at gmail.com> > Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92483 > Signed-off-by: Daniel Vetter <daniel.vetter at intel.com> > --- > drivers/gpu/drm/drm_fb_helper.c | 27 +++++++++++++++++++++++++-- > 1 file changed, 25 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c > index 0ac0fcc9b0d2..b2cf28dd90fe 100644 > --- a/drivers/gpu/drm/drm_fb_helper.c > +++ b/drivers/gpu/drm/drm_fb_helper.c > @@ -1249,6 +1249,8 @@ retry: > > mode_set = &fb_helper->crtc_info[i].mode_set; > > + mode_set->crtc->primary->old_fb = mode_set->crtc->primary->fb; > + > mode_set->x = var->xoffset; > mode_set->y = var->yoffset; > > @@ -1264,13 +1266,34 @@ retry: > info->var.xoffset = var->xoffset; > info->var.yoffset = var->yoffset; > > - return 0; > > fail: > + for(i = 0; i < fb_helper->crtc_count; i++) { > + struct drm_mode_set *mode_set; > + struct drm_plane *plane; > + > + mode_set = &fb_helper->crtc_info[i].mode_set; > + plane = mode_set->crtc->primary; > + > + if (ret == 0) { > + struct drm_framebuffer *new_fb = plane->state->fb; > + > + if (new_fb) > + drm_framebuffer_reference(new_fb); > + plane->fb = new_fb; > + plane->crtc = plane->state->crtc; > + > + if (plane->old_fb) > + drm_framebuffer_unreference(plane->old_fb); > + } > + plane->old_fb = NULL; > + } > + > if (ret == -EDEADLK) > goto backoff; > > - drm_atomic_state_free(state); > + if (ret != 0) > + drm_atomic_state_free(state); > > return ret; > > -- > 2.5.1 >
