[PATCH v2 1/2] drm/crtc: fix connector reference counting mismatch in drm_crtc_helper_set_config

[Lucas Stach]

Am Montag, den 13.06.2016, 20:18 +0200 schrieb Daniel Vetter:
[...]
> > > > Only the reference count of connectors that weren't previously bound to
> > > > an encoder should be incremented after a call to drm_crtc_helper_set_config.
> > > > And only the reference count of connectors that were previously bound to
> > > > an encoder and are unbound afterwards should ever be decremented.
> > > > The reference counts of the temporary copies in the save_connectors
> > > > should not be touched at all.
> > > > 
> > > > This patch fixes the above error by only incrementing the reference count
> > > > of those connectors in the set that are initially not bound to any encoder,
> > > > and also by restoring the reference count of only those connectors in the
> > > > set in the failure case.
> > > > 
> > > > Fixes: 0955c1250e96 ("drm/crtc: take references to connectors used in a modeset. (v2)")
> > > > Signed-off-by: Philipp Zabel <p.zabel at pengutronix.de>
> > > 
> > > I'd like to analyze this bug first a bit more (since it seems to be imx
> > > specific) before review/merging, per our ongoing discussion. The current
> > > code is definitely wrong, but looking at it I more expected a leak (since
> > > we decrement saved structures, not the real ones), not an explosion.
> > > -Daniel
> > > 
> > There is a regression bug open against nouveau, which shows the same
> > symptoms and is fixed by these patches.
> > 
> > https://bugzilla.kernel.org/show_bug.cgi?id=119861
> > 
> > It is not specific to imx-drm, but doesn't explode on desktop system
> > right away, probably due to the FB emulation holding a reference to all
> > connectors.
> 
> Sensible theory. Can you confirm that enabling fbdev emulation on imx
> works around this?

Yes, we are unable to reproduce the issue if fbdev emulation is enabled.

Regards,
Lucas