From c182b15c3abee75cdc9d9564b6ab826403690f4e Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sat, 28 Feb 2015 21:44:48 -0800 Subject: [PATCH] Workaround for drm bug Signed-off-by: Linus Torvalds --- drivers/gpu/drm/i915/intel_atomic_plane.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_atomic_plane.c b/drivers/gpu/drm/i915/intel_atomic_plane.c index 9e6f727..72714d3 100644 --- a/drivers/gpu/drm/i915/intel_atomic_plane.c +++ b/drivers/gpu/drm/i915/intel_atomic_plane.c @@ -85,8 +85,23 @@ intel_plane_duplicate_state(struct drm_plane *plane) return NULL; state = &intel_state->base; - if (state->fb) - drm_framebuffer_reference(state->fb); + + /* + * We cannot do drm_framebuffer_reference(), because the reference + * may already have been dropped. + * + * So we do what drm_framebuffer_lookup() does, namely do a + * kref_get_unless_zero(). Even that is somewhat questionable, + * in that maybe the 'fb' already got free'd. So warn loudly + * about this. + * + * Maybe the base.fb should be cleared by whatever drops the + * reference? + */ + if (state->fb && !kref_get_unless_zero(&state->fb->refcount)) { + state->fb = NULL; + WARN_ONCE(1, "intel_plane_duplicate_state got plane with dead frame buffer"); + } return state; } -- 2.3.1.167.g7f4ba4b