drm/core: Fix old_fb handling in restore_fbdev_mode_atomic.

Don't touch plane->old_fb/fb without having the right locks held.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1447237751-9663-5-git-send-email-maarten.lankhorst@ubuntu.com

1 files changed, 6 insertions, 15 deletions

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index e673c13c7391..abd50863506e 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,6 +342,7 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
         struct drm_plane *plane;
         struct drm_atomic_state *state;
         int i, ret;
+        unsigned plane_mask;
 
         state = drm_atomic_state_alloc(dev);
         if (!state)
@@ -349,11 +350,10 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
 
         state->acquire_ctx = dev->mode_config.acquire_ctx;
 retry:
+        plane_mask = 0;
         drm_for_each_plane(plane, dev) {
                 struct drm_plane_state *plane_state;
 
-                plane->old_fb = plane->fb;
-
                 plane_state = drm_atomic_get_plane_state(state, plane);
                 if (IS_ERR(plane_state)) {
                         ret = PTR_ERR(plane_state);
@@ -362,6 +362,9 @@ retry:
 
                 plane_state->rotation = BIT(DRM_ROTATE_0);
 
+                plane->old_fb = plane->fb;
+                plane_mask |= 1 << drm_plane_index(plane);
+
                 /* disable non-primary: */
                 if (plane->type == DRM_PLANE_TYPE_PRIMARY)
                         continue;
@@ -382,19 +385,7 @@ retry:
         ret = drm_atomic_commit(state);
 
 fail:
-        drm_for_each_plane(plane, dev) {
-                if (ret == 0) {
-                        struct drm_framebuffer *new_fb = plane->state->fb;
-                        if (new_fb)
-                                drm_framebuffer_reference(new_fb);
-                        plane->fb = new_fb;
-                        plane->crtc = plane->state->crtc;
-
-                        if (plane->old_fb)
-                                drm_framebuffer_unreference(plane->old_fb);
-                }
-                plane->old_fb = NULL;
-        }
+        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
         if (ret == -EDEADLK)
                 goto backoff;