[PATCH 01/15] drm: omapdrm: Fix plane state free in plane reset handler

[Tomi Valkeinen]

On 05/12/15 00:27, Laurent Pinchart wrote:
> The plane reset handler frees the plane state and allocates a new
> default state, but when doing so attempt to free the plane state using
> the base plane state pointer instead of casting it to the
> driver-specific state object that has been allocated. Fix it by using
> the omap_plane_atomic_destroy_state() function to destroy the plane
> state instead of duplicating the code.
> 
> Signed-off-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
> ---
>  drivers/gpu/drm/omapdrm/omap_plane.c | 53 ++++++++++++++++++------------------
>  1 file changed, 26 insertions(+), 27 deletions(-)
> 
> diff --git a/drivers/gpu/drm/omapdrm/omap_plane.c b/drivers/gpu/drm/omapdrm/omap_plane.c
> index 3054bda72688..11d406b160e1 100644
> --- a/drivers/gpu/drm/omapdrm/omap_plane.c
> +++ b/drivers/gpu/drm/omapdrm/omap_plane.c
> @@ -188,33 +188,6 @@ static const struct drm_plane_helper_funcs omap_plane_helper_funcs = {
>  	.atomic_disable = omap_plane_atomic_disable,
>  };
>  
> -static void omap_plane_reset(struct drm_plane *plane)
> -{
> -	struct omap_plane *omap_plane = to_omap_plane(plane);
> -	struct omap_plane_state *omap_state;
> -
> -	if (plane->state && plane->state->fb)
> -		drm_framebuffer_unreference(plane->state->fb);
> -
> -	kfree(plane->state);
> -	plane->state = NULL;
> -
> -	omap_state = kzalloc(sizeof(*omap_state), GFP_KERNEL);
> -	if (omap_state == NULL)
> -		return;
> -
> -	/*
> -	 * Set defaults depending on whether we are a primary or overlay
> -	 * plane.
> -	 */
> -	omap_state->zorder = plane->type == DRM_PLANE_TYPE_PRIMARY
> -			   ? 0 : omap_plane->id;
> -	omap_state->base.rotation = BIT(DRM_ROTATE_0);
> -
> -	plane->state = &omap_state->base;
> -	plane->state->plane = plane;
> -}
> -
>  static void omap_plane_destroy(struct drm_plane *plane)
>  {
>  	struct omap_plane *omap_plane = to_omap_plane(plane);
> @@ -270,6 +243,32 @@ static void omap_plane_atomic_destroy_state(struct drm_plane *plane,
>  	kfree(to_omap_plane_state(state));
>  }
>  
> +static void omap_plane_reset(struct drm_plane *plane)
> +{
> +	struct omap_plane *omap_plane = to_omap_plane(plane);
> +	struct omap_plane_state *omap_state;
> +
> +	if (plane->state) {
> +		omap_plane_atomic_destroy_state(plane, plane->state);
> +		plane->state = NULL;
> +	}
> +
> +	omap_state = kzalloc(sizeof(*omap_state), GFP_KERNEL);
> +	if (omap_state == NULL)
> +		return;
> +
> +	/*
> +	 * Set defaults depending on whether we are a primary or overlay
> +	 * plane.
> +	 */
> +	omap_state->zorder = plane->type == DRM_PLANE_TYPE_PRIMARY
> +			   ? 0 : omap_plane->id;
> +	omap_state->base.rotation = BIT(DRM_ROTATE_0);
> +
> +	plane->state = &omap_state->base;
> +	plane->state->plane = plane;
> +}
> +
>  static int omap_plane_atomic_set_property(struct drm_plane *plane,
>  					  struct drm_plane_state *state,
>  					  struct drm_property *property,
> 

This one moves the function, so it's pretty hard to see what actually
was changed.

 Tomi

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20151209/d6a1130c/attachment.sig>