Linux v4.0-rc5-25-g90a5a895cc8b

- Add some i915 fixes

1 files changed, 72 insertions, 0 deletions

diff --git a/drm-Fixup-racy-refcounting-in-plane_force_disable.patch b/drm-Fixup-racy-refcounting-in-plane_force_disable.patch
new file mode 100644
index 000000000..6c46cb007
--- /dev/null
+++ b/drm-Fixup-racy-refcounting-in-plane_force_disable.patch
@@ -0,0 +1,72 @@
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 27 Feb 2015 12:58:13 +0100
+Subject: [PATCH] drm: Fixup racy refcounting in plane_force_disable
+
+Originally it was impossible to be dropping the last refcount in this
+function since there was always one around still from the idr. But in
+
+commit 83f45fc360c8e16a330474860ebda872d1384c8c
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date:   Wed Aug 6 09:10:18 2014 +0200
+
+    drm: Don't grab an fb reference for the idr
+
+we've switched to weak references, broke that assumption but forgot to
+fix it up.
+
+Since we still force-disable planes it's only possible to hit this
+when racing multiple rmfb with fbdev restoring or similar evil things.
+As long as userspace is nice it's impossible to hit the BUG_ON.
+
+But the BUG_ON would most likely be hit from fbdev code, which usually
+invovles the console_lock besides all modeset locks. So very likely
+we'd never get the bug reports if this was hit in the wild, hence
+better be safe than sorry and backport.
+
+Spotted by Matt Roper while reviewing other patches.
+
+[airlied: pull this back into 4.0 - the oops happens there]
+
+Cc: stable@vger.kernel.org
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+---
+ drivers/gpu/drm/drm_crtc.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index f6d04c7b5115..679b10e34fb5 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
+ }
+ EXPORT_SYMBOL(drm_framebuffer_reference);
+ 
+-static void drm_framebuffer_free_bug(struct kref *kref)
+-{
+-	BUG();
+-}
+-
+-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+-{
+-	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
+-	kref_put(&fb->refcount, drm_framebuffer_free_bug);
+-}
+-
+ /**
+  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+  * @fb: fb to unregister
+@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
+ 		return;
+ 	}
+ 	/* disconnect the plane from the fb and crtc: */
+-	__drm_framebuffer_unreference(plane->old_fb);
++	drm_framebuffer_unreference(plane->old_fb);
+ 	plane->old_fb = NULL;
+ 	plane->fb = NULL;
+ 	plane->crtc = NULL;
+-- 
+2.1.0
+