Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75dfca80 authored by Jesse Barnes's avatar Jesse Barnes Committed by Eric Anholt
Browse files

drm/i915: hold ref on flip object until it completes 



This will prevent things from falling over if the user frees the flip
buffer before we complete the flip, since we'll hold an internal
reference.

Reported-by: default avatarKristian Høgsberg <krh@bitplanet.net>
Signed-off-by: default avatarJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
parent 84b79f8d

drivers/gpu/drm/i915/intel_display.c

+3 −1
Original line number Diff line number Diff line
@@ -4094,6 +4094,7 @@ static void intel_unpin_work_fn(struct work_struct *__work) 


	mutex_lock(&work->dev->struct_mutex);

	i915_gem_object_unpin(work->old_fb_obj);

	drm_gem_object_unreference(work->pending_flip_obj);

	drm_gem_object_unreference(work->old_fb_obj);

	mutex_unlock(&work->dev->struct_mutex);

	kfree(work);
@@ -4221,8 +4222,9 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, 
		return ret;

	}



	/* Reference the old fb object for the scheduled work. */

	/* Reference the objects for the scheduled work. */

	drm_gem_object_reference(work->old_fb_obj);

	drm_gem_object_reference(obj);



	crtc->fb = fb;

	i915_gem_object_flush_write_domain(obj);