Possible fb ref count issue with drm_plane_force_disable()

[Tomi Valkeinen]

On 15/04/14 13:29, Andrzej Hajda wrote:

> I have experienced similar problem with exynos_drm. I have found that
> in exynos_drm_crtc_mode_set there is line:
> 
> 	plane->fb = crtc->primary->fb;
> 
> without drm_framebuffer_reference.
> In result drm_framebuffer_remove dereferences it twice:
> - because of crtc->primary->fb == fb,
> - because of fb being on dev->mode_config.plane_list
> 
> I am not sure how it should be solved properly, but adding
> drm_framebuffer_reference in exynos_drm_crtc_mode_set helps.
> 
> In omap_plane_mode_set there is also assignment:
> 
> 	plane->fb = fb
> 
> without drm_framebuffer_reference so maybe it can be solved the same way.

The omap_plane_mode_set() is called also when using non-primary planes.
For those the refcounting goes right at the moment (I think), so adding
drm_framebuffer_reference() at that func would break it.

I guess I could check if the plane is primary, and add ref only then. Or
add the ref in omap_crtc, before it calls omap_plane_mode_set(). Both
feel a bit hacky...

 Tomi


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20140415/8d4e301b/attachment-0001.sig>