aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJesse Barnes <jbarnes@virtuousgeek.org>2010-02-10 15:09:44 -0800
committerEric Anholt <eric@anholt.net>2010-02-10 17:34:46 -0800
commit75dfca80a610e4e87d3b9ccfb3f520692808697d (patch)
treef36aec97c8e6a6ff7c8c169a2ab5fc078074593c
parent84b79f8d2882b0a84330c04839ed4d3cefd2ff77 (diff)
downloadlinux-linaro-stable-75dfca80a610e4e87d3b9ccfb3f520692808697d.tar.gz
drm/i915: hold ref on flip object until it completes
This will prevent things from falling over if the user frees the flip buffer before we complete the flip, since we'll hold an internal reference. Reported-by: Kristian Høgsberg <krh@bitplanet.net> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net>
-rw-r--r--drivers/gpu/drm/i915/intel_display.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index c161ace7132d..b27202d23ebc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4094,6 +4094,7 @@ static void intel_unpin_work_fn(struct work_struct *__work)
mutex_lock(&work->dev->struct_mutex);
i915_gem_object_unpin(work->old_fb_obj);
+ drm_gem_object_unreference(work->pending_flip_obj);
drm_gem_object_unreference(work->old_fb_obj);
mutex_unlock(&work->dev->struct_mutex);
kfree(work);
@@ -4221,8 +4222,9 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
return ret;
}
- /* Reference the old fb object for the scheduled work. */
+ /* Reference the objects for the scheduled work. */
drm_gem_object_reference(work->old_fb_obj);
+ drm_gem_object_reference(obj);
crtc->fb = fb;
i915_gem_object_flush_write_domain(obj);