From 61e1cf76c2bbac63430c23ac04eddf9d8d56a1e0 Mon Sep 17 00:00:00 2001 From: Alexander Boettcher Date: Tue, 18 Oct 2016 16:14:46 +0200 Subject: [PATCH] intel_fb: fix framebuffer freeup drm_framebuffer_remove takes care of references to CRTC pointers before freeing up framebuffer object. Directly calling the destroy function may cause dangling CRTC pointers pointing inside the framebuffer object. Fixes #2140 --- repos/dde_linux/patches/intel_fb_drm_remove.patch | 13 +++++++++++++ repos/dde_linux/ports/dde_linux.hash | 2 +- repos/dde_linux/ports/dde_linux.port | 1 + .../src/drivers/framebuffer/intel/lx_emul.cc | 3 ++- 4 files changed, 17 insertions(+), 2 deletions(-) create mode 100644 repos/dde_linux/patches/intel_fb_drm_remove.patch diff --git a/repos/dde_linux/patches/intel_fb_drm_remove.patch b/repos/dde_linux/patches/intel_fb_drm_remove.patch new file mode 100644 index 0000000000..21372bfafc --- /dev/null +++ b/repos/dde_linux/patches/intel_fb_drm_remove.patch @@ -0,0 +1,13 @@ +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -13567,6 +13568,10 @@ + intel_crtc = to_intel_crtc(crtc); + + plane->fb = fb; ++ ++ if (!crtc) ++ return; ++ + crtc->x = src->x1 >> 16; + crtc->y = src->y1 >> 16; + diff --git a/repos/dde_linux/ports/dde_linux.hash b/repos/dde_linux/ports/dde_linux.hash index 88c5e11146..1efae2128c 100644 --- a/repos/dde_linux/ports/dde_linux.hash +++ b/repos/dde_linux/ports/dde_linux.hash @@ -1 +1 @@ -a94822e34f6074f3bb84c5300925c72502066eb0 +01af4e74fb2b25133f181d1b73d673b9683c330b diff --git a/repos/dde_linux/ports/dde_linux.port b/repos/dde_linux/ports/dde_linux.port index 19ade950c5..fe404308d9 100644 --- a/repos/dde_linux/ports/dde_linux.port +++ b/repos/dde_linux/ports/dde_linux.port @@ -193,5 +193,6 @@ PATCH_OPT(patches/usb_usbnet.patch) := $(USB_OPT) # INTEL FB PATCH_OPT(patches/intel_fb_export_api.patch) := -p1 -d$(SRC_DIR_INTEL_FB) +PATCH_OPT(patches/intel_fb_drm_remove.patch) := -p1 -d$(SRC_DIR_INTEL_FB) # vi: set ft=make : diff --git a/repos/dde_linux/src/drivers/framebuffer/intel/lx_emul.cc b/repos/dde_linux/src/drivers/framebuffer/intel/lx_emul.cc index cda3fe1d31..d7a0d05e03 100644 --- a/repos/dde_linux/src/drivers/framebuffer/intel/lx_emul.cc +++ b/repos/dde_linux/src/drivers/framebuffer/intel/lx_emul.cc @@ -188,7 +188,8 @@ void Framebuffer::Driver::update_mode() } if (old._lx.addr) Lx::iounmap(old._lx.addr); - if (old._lx.lx_fb) old._lx.lx_fb->funcs->destroy(old._lx.lx_fb); + /* drm_crtc.h in drm_framebuffer_funcs definition: use drm_fb_remove */ + if (old._lx.lx_fb) drm_framebuffer_remove(old._lx.lx_fb); }