[Intel-gfx] [PATCH 2/2] drm/fb-helper: Fix fb refcounting in pan_display_atomic

[Daniel Vetter]

In

commit bbb1e52402b2a288b09ae37e8182599931c7e9df
Author: Rob Clark <robdclark at gmail.com>
Date:   Tue Aug 25 15:35:58 2015 -0400

    drm/fb-helper: atomic restore_fbdev_mode()..

we've forgotten to do the plane->old_fb refcount dance for
pan_display_atomic, which can result in refcount leaks if the current
configuration is not from fbcon. Which apparently can happen when
vt-switching - fbcon does a pan first before a set_par.

OCD-align function parameters while at it.

Cc: Rob Clark <robdclark at gmail.com>
Cc: Rodrigo Vivi <rodrigo.vivi at gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92483
Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
---
 drivers/gpu/drm/drm_fb_helper.c | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 0ac0fcc9b0d2..b2cf28dd90fe 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1249,6 +1249,8 @@ retry:
 
 		mode_set = &fb_helper->crtc_info[i].mode_set;
 
+		mode_set->crtc->primary->old_fb = mode_set->crtc->primary->fb;
+
 		mode_set->x = var->xoffset;
 		mode_set->y = var->yoffset;
 
@@ -1264,13 +1266,34 @@ retry:
 	info->var.xoffset = var->xoffset;
 	info->var.yoffset = var->yoffset;
 
-	return 0;
 
 fail:
+	for(i = 0; i < fb_helper->crtc_count; i++) {
+		struct drm_mode_set *mode_set;
+		struct drm_plane *plane;
+
+		mode_set = &fb_helper->crtc_info[i].mode_set;
+		plane = mode_set->crtc->primary;
+
+		if (ret == 0) {
+			struct drm_framebuffer *new_fb = plane->state->fb;
+
+			if (new_fb)
+				drm_framebuffer_reference(new_fb);
+			plane->fb = new_fb;
+			plane->crtc = plane->state->crtc;
+
+			if (plane->old_fb)
+				drm_framebuffer_unreference(plane->old_fb);
+		}
+		plane->old_fb = NULL;
+	}
+
 	if (ret == -EDEADLK)
 		goto backoff;
 
-	drm_atomic_state_free(state);
+	if (ret != 0)
+		drm_atomic_state_free(state);
 
 	return ret;
 
-- 
2.5.1