[PATCH] drm/crtc-helper: Fixup error handling in drm_helper_crtc_mode_set

[Daniel Stone]

Hi,

> On 2 Jul 2015, at 2:16 pm, Daniel Vetter <daniel.vetter at ffwll.ch> wrote:
> 
> In
> 
> commit 9f658b7b62e7aefc1ee067136126eca3f58cabfd
> Author: Daniel Stone <daniels at collabora.com>
> Date:   Fri May 22 13:34:45 2015 +0100
> 
>    drm/crtc_helper: Replace open-coded CRTC state helpers
> 
> error handling code was broken, resulting in the first path not being
> checked correctly. Fix this by using the same pattern as in the
> transitional plane helper function drm_plane_helper_update.
> 
> v2: Simplify the cleanup code while at it too.
> 
> v3: After some debugging with John we realized that the above patch
> from Daniel also accidentally removed the if (crtc_state) check. This
> is legal when transitioning to atomic, when the initial state reset
> isn't all wired up yet properly. Reinstate that check to fix the bug
> John has hit.

Still misses the crtc_state->crtc assignment in the kzalloc path.

Cheers,
Daniel

> Cc: Daniel Stone <daniels at collabora.com>
> CC: Sean Paul <seanpaul at chromium.org>
> Cc: John Hunter <zhaojunwang at pku.edu.cn>
> Reported-by: John Hunter <zhaojunwang at pku.edu.cn>
> Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
> ---
> drivers/gpu/drm/drm_crtc_helper.c | 24 +++++++++++-------------
> 1 file changed, 11 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
> index 393114df88a3..93104f3555f5 100644
> --- a/drivers/gpu/drm/drm_crtc_helper.c
> +++ b/drivers/gpu/drm/drm_crtc_helper.c
> @@ -927,15 +927,13 @@ int drm_helper_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mod
> 
>    if (crtc->funcs->atomic_duplicate_state)
>        crtc_state = crtc->funcs->atomic_duplicate_state(crtc);
> -    else {
> +    else if (crtc->state)
> +        crtc_state = drm_atomic_helper_crtc_duplicate_state(crtc);
> +    else
>        crtc_state = kzalloc(sizeof(*crtc_state), GFP_KERNEL);
> -        if (!crtc_state)
> -            return -ENOMEM;
> -        if (crtc->state)
> -            __drm_atomic_helper_crtc_duplicate_state(crtc, crtc_state);
> -        else
> -            crtc_state->crtc = crtc;
> -    }
> +
> +    if (!crtc_state)
> +        return -ENOMEM;
> 
>    crtc_state->planes_changed = true;
>    crtc_state->mode_changed = true;
> @@ -957,11 +955,11 @@ int drm_helper_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mod
>    ret = drm_helper_crtc_mode_set_base(crtc, x, y, old_fb);
> 
> out:
> -    if (crtc->funcs->atomic_destroy_state)
> -        crtc->funcs->atomic_destroy_state(crtc, crtc_state);
> -    else {
> -        __drm_atomic_helper_crtc_destroy_state(crtc, crtc_state);
> -        kfree(crtc_state);
> +    if (crtc_state) {
> +        if (crtc->funcs->atomic_destroy_state)
> +            crtc->funcs->atomic_destroy_state(crtc, crtc_state);
> +        else
> +            drm_atomic_helper_crtc_destroy_state(crtc, crtc_state);
>    }
> 
>    return ret;
> -- 
> 2.1.4
>