Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a35f83b authored by Ville Syrjälä's avatar Ville Syrjälä Committed by Daniel Vetter
Browse files

drm/i915: Don't clobber crtc->fb when queue_flip fails 



Restore crtc->fb to the old framebuffer if queue_flip fails.

While at it, kill the pointless intel_fb temp variable.

v2: Update crtc->fb before queue_flip and restore it back
    after a failure.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Reported-and-Tested-by: default avatarMika Kuoppala <mika.kuoppala@intel.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent b18ac466

drivers/gpu/drm/i915/intel_display.c

+4 −7
Original line number Diff line number Diff line
@@ -7264,8 +7264,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, 
{

	struct drm_device *dev = crtc->dev;

	struct drm_i915_private *dev_priv = dev->dev_private;

	struct intel_framebuffer *intel_fb;

	struct drm_i915_gem_object *obj;

	struct drm_framebuffer *old_fb = crtc->fb;

	struct drm_i915_gem_object *obj = to_intel_framebuffer(fb)->obj;

	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);

	struct intel_unpin_work *work;

	unsigned long flags;
@@ -7290,8 +7290,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, 


	work->event = event;

	work->crtc = crtc;

	intel_fb = to_intel_framebuffer(crtc->fb);

	work->old_fb_obj = intel_fb->obj;

	work->old_fb_obj = to_intel_framebuffer(old_fb)->obj;

	INIT_WORK(&work->work, intel_unpin_work_fn);



	ret = drm_vblank_get(dev, intel_crtc->pipe);
@@ -7311,9 +7310,6 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, 
	intel_crtc->unpin_work = work;

	spin_unlock_irqrestore(&dev->event_lock, flags);



	intel_fb = to_intel_framebuffer(fb);

	obj = intel_fb->obj;



	if (atomic_read(&intel_crtc->unpin_work_count) >= 2)

		flush_workqueue(dev_priv->wq);
@@ -7348,6 +7344,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, 


cleanup_pending:

	atomic_dec(&intel_crtc->unpin_work_count);

	crtc->fb = old_fb;

	drm_gem_object_unreference(&work->old_fb_obj->base);

	drm_gem_object_unreference(&obj->base);

	mutex_unlock(&dev->struct_mutex);