[Intel-gfx] [PATCH] drm/i915: hold ref on flip object until it completes

[Eric Anholt]

On Wed, 10 Feb 2010 14:55:56 -0800, Jesse Barnes <jbarnes at virtuousgeek.org> wrote:
> This will prevent things from falling over if the user frees the flip
> buffer before we complete the flip, since we'll hold an internal
> reference.
> 
> Reported-by: Kristian Høgsberg <krh at bitplanet.net>
> Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
> 
> diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> index 2476fb4..372a2f5 100644
> --- a/drivers/gpu/drm/i915/intel_display.c
> +++ b/drivers/gpu/drm/i915/intel_display.c
> @@ -4039,6 +4039,9 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
>  	    atomic_dec_and_test(&obj_priv->pending_flip))
>  		DRM_WAKEUP(&dev_priv->pending_flip_queue);
>  	schedule_work(&work->work);
> +
> +	/* Drop the flip ref we took when the ioctl was called */
> +	drm_gem_object_unreference(work->pending_flip_obj);
>  }
>  
>  void intel_prepare_page_flip(struct drm_device *dev, int plane)
> @@ -4109,8 +4112,9 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
>  		return ret;
>  	}
>  
> -	/* Reference the old fb object for the scheduled work. */
> +	/* Reference the objects for the scheduled work. */
>  	drm_gem_object_reference(work->old_fb_obj);
> +	drm_gem_object_reference(obj);
>  
>  	crtc->fb = fb;
>  	i915_gem_object_flush_write_domain(obj);

This seems obvious, so I'll push it out now.  Thanks!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/intel-gfx/attachments/20100210/cdbee341/attachment.sig>