From 75dfca80a610e4e87d3b9ccfb3f520692808697d Mon Sep 17 00:00:00 2001 From: Jesse Barnes Date: Wed, 10 Feb 2010 15:09:44 -0800 Subject: drm/i915: hold ref on flip object until it completes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This will prevent things from falling over if the user frees the flip buffer before we complete the flip, since we'll hold an internal reference. Reported-by: Kristian Høgsberg Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt --- drivers/gpu/drm/i915/intel_display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/gpu') diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index c161ace7132d..b27202d23ebc 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -4094,6 +4094,7 @@ static void intel_unpin_work_fn(struct work_struct *__work) mutex_lock(&work->dev->struct_mutex); i915_gem_object_unpin(work->old_fb_obj); + drm_gem_object_unreference(work->pending_flip_obj); drm_gem_object_unreference(work->old_fb_obj); mutex_unlock(&work->dev->struct_mutex); kfree(work); @@ -4221,8 +4222,9 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, return ret; } - /* Reference the old fb object for the scheduled work. */ + /* Reference the objects for the scheduled work. */ drm_gem_object_reference(work->old_fb_obj); + drm_gem_object_reference(obj); crtc->fb = fb; i915_gem_object_flush_write_domain(obj); -- cgit v1.2.2