[git pull] drm fixes

[Linus Torvalds]

On Sun, Mar 1, 2015 at 1:00 PM, Linus Torvalds
<torvalds at linux-foundation.org> wrote:
>
> Back to the drawing board.

Ok, many hours later, but I found it.

The bisection was a disaster, having to work around other bugs in this
area, but it ended up getting "close enough" that I figured out what
went wrong.

The "intel_plane_duplicate_state()" is horribly horribly buggy. It
looks at the state->fb pointer, but it may have been free'd already.

This workaround "works for me", but it's really still very
questionable, because while the "kref_get_unless_zero()" works
correctly when the last reference has been dropped, I'm not sure that
there is any guarantee that the whole allocation even exists any more,
so I think the *correct* thing to do would be to clear state->fb when
dropping the kref. But this was the smallest working patch I could
come up with. Somebody who actually knows the code should start
looking at the places that do drm_framebuffer_unreference(), and
actually clear that pointer instead.

Added Matt Roper and Ander Conselvan de Oliveira to the discussion,
since they are the ones git says are involved with the original broken
intel_plane_duplicate_state().

Anyway, attached is

 (a) the patch with a big comment

 (b) the warnings I get on that machine that show where this problem
triggers (and another warning earlier).

Comments? I'm sure this probably only triggers with *old* X servers
that don't do all the modern dri stuff.

                               Linus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Workaround-for-drm-bug.patch
Type: text/x-patch
Size: 1424 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20150301/63ed96c2/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: drm-bug-dmesg
Type: application/octet-stream
Size: 6501 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20150301/63ed96c2/attachment-0001.obj>