intel_fb: fix framebuffer freeup

drm_framebuffer_remove takes care of references to CRTC pointers before
freeing up framebuffer object. Directly calling the destroy function may cause
dangling CRTC pointers pointing inside the framebuffer object.

Fixes 
This commit is contained in:
Alexander Boettcher 2016-10-18 16:14:46 +02:00 committed by Christian Helmuth
parent 9d84541e6f
commit 61e1cf76c2
4 changed files with 17 additions and 2 deletions
repos/dde_linux

@ -0,0 +1,13 @@
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -13567,6 +13568,10 @@
intel_crtc = to_intel_crtc(crtc);
plane->fb = fb;
+
+ if (!crtc)
+ return;
+
crtc->x = src->x1 >> 16;
crtc->y = src->y1 >> 16;

@ -1 +1 @@
a94822e34f6074f3bb84c5300925c72502066eb0
01af4e74fb2b25133f181d1b73d673b9683c330b

@ -193,5 +193,6 @@ PATCH_OPT(patches/usb_usbnet.patch) := $(USB_OPT)
# INTEL FB
PATCH_OPT(patches/intel_fb_export_api.patch) := -p1 -d$(SRC_DIR_INTEL_FB)
PATCH_OPT(patches/intel_fb_drm_remove.patch) := -p1 -d$(SRC_DIR_INTEL_FB)
# vi: set ft=make :

@ -188,7 +188,8 @@ void Framebuffer::Driver::update_mode()
}
if (old._lx.addr) Lx::iounmap(old._lx.addr);
if (old._lx.lx_fb) old._lx.lx_fb->funcs->destroy(old._lx.lx_fb);
/* drm_crtc.h in drm_framebuffer_funcs definition: use drm_fb_remove */
if (old._lx.lx_fb) drm_framebuffer_remove(old._lx.lx_fb);
}