Possible fb ref count issue with drm_plane_force_disable()

[Rob Clark]

On Tue, Apr 15, 2014 at 6:44 AM, Tomi Valkeinen <tomi.valkeinen at ti.com> wrote:
> On 15/04/14 13:29, Andrzej Hajda wrote:
>
>> I have experienced similar problem with exynos_drm. I have found that
>> in exynos_drm_crtc_mode_set there is line:
>>
>>       plane->fb = crtc->primary->fb;
>>
>> without drm_framebuffer_reference.
>> In result drm_framebuffer_remove dereferences it twice:
>> - because of crtc->primary->fb == fb,
>> - because of fb being on dev->mode_config.plane_list
>>
>> I am not sure how it should be solved properly, but adding
>> drm_framebuffer_reference in exynos_drm_crtc_mode_set helps.
>>
>> In omap_plane_mode_set there is also assignment:
>>
>>       plane->fb = fb
>>
>> without drm_framebuffer_reference so maybe it can be solved the same way.
>
> The omap_plane_mode_set() is called also when using non-primary planes.
> For those the refcounting goes right at the moment (I think), so adding
> drm_framebuffer_reference() at that func would break it.
>
> I guess I could check if the plane is primary, and add ref only then. Or
> add the ref in omap_crtc, before it calls omap_plane_mode_set(). Both
> feel a bit hacky...

probably split out omap_plane_mode_set_internal(), call that directly
from update_plane() for plane operations.  And then do the refcnt
dance in the new omap_plane_mode_set() which calls _internal()..

BR,
-R

>  Tomi
>
>