Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3463cf1a authored by Patrik Jakobsson's avatar Patrik Jakobsson
Browse files

drm/gma500/psb: Fix cursor gem obj referencing on psb 



The internal crtc cursor gem object pointer was never set/updated since
it was required to be set in the first place.

Fixing this will make the pin/unpin count match and prevent cursor
objects from leaking when userspace drops all references to it. Also
make sure we drop the gem obj reference on failure.

This patch only affects Poulsbo chips.

Signed-off-by: default avatarPatrik Jakobsson <patrik.r.jakobsson@gmail.com>
parent 22e7c385

drivers/gpu/drm/gma500/psb_intel_display.c

+13 −6
Original line number Diff line number Diff line
@@ -843,7 +843,7 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc, 
	struct gtt_range *cursor_gt = psb_intel_crtc->cursor_gt;

	struct drm_gem_object *obj;

	void *tmp_dst, *tmp_src;

	int ret, i, cursor_pages;

	int ret = 0, i, cursor_pages;



	/* if we want to turn of the cursor ignore width and height */

	if (!handle) {
@@ -880,7 +880,8 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc, 


	if (obj->size < width * height * 4) {

		dev_dbg(dev->dev, "buffer is to small\n");

		return -ENOMEM;

		ret = -ENOMEM;

		goto unref_cursor;

	}



	gt = container_of(obj, struct gtt_range, gem);
@@ -889,13 +890,14 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc, 
	ret = psb_gtt_pin(gt);

	if (ret) {

		dev_err(dev->dev, "Can not pin down handle 0x%x\n", handle);

		return ret;

		goto unref_cursor;

	}



	if (dev_priv->ops->cursor_needs_phys) {

		if (cursor_gt == NULL) {

			dev_err(dev->dev, "No hardware cursor mem available");

			return -ENOMEM;

			ret = -ENOMEM;

			goto unref_cursor;

		}



		/* Prevent overflow */
@@ -936,9 +938,14 @@ static int psb_intel_crtc_cursor_set(struct drm_crtc *crtc, 
							struct gtt_range, gem);

		psb_gtt_unpin(gt);

		drm_gem_object_unreference(psb_intel_crtc->cursor_obj);

		psb_intel_crtc->cursor_obj = obj;

	}

	return 0;



	psb_intel_crtc->cursor_obj = obj;

	return ret;



unref_cursor:

	drm_gem_object_unreference(obj);

	return ret;

}



static int psb_intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)