From patchwork Thu May 19 15:15:01 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans de Goede X-Patchwork-Id: 9127797 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C6FD960213 for ; Thu, 19 May 2016 15:15:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BA8A0281BC for ; Thu, 19 May 2016 15:15:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AF236281C3; Thu, 19 May 2016 15:15:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7E686281BC for ; Thu, 19 May 2016 15:15:14 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B80CC6E052; Thu, 19 May 2016 15:15:10 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by gabe.freedesktop.org (Postfix) with ESMTPS id B7CAE6E052 for ; Thu, 19 May 2016 15:15:08 +0000 (UTC) Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 29C13C04B312; Thu, 19 May 2016 15:15:08 +0000 (UTC) Received: from shalem.localdomain.com (vpn1-6-160.ams2.redhat.com [10.36.6.160]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u4JFF348016930; Thu, 19 May 2016 11:15:04 -0400 From: Hans de Goede To: Dave Airlie Subject: [PATCH] Revert "drm/core: Preserve the framebuffer after removing it." Date: Thu, 19 May 2016 17:15:01 +0200 Message-Id: <1463670901-31153-1-git-send-email-hdegoede@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 19 May 2016 15:15:08 +0000 (UTC) Cc: stable@vger.kenrel.org, Daniel Vetter , stable@vger.kernel.org, Hans de Goede , dri-devel@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP This reverts commit 13803132818c ("drm/core: Preserve the framebuffer after removing it."). This commit assumes that going through drm_framebuffer_remove() is not necessary because "the fbdev code or any system compositor should restore the planes anyway so there's no need to do it twice". But this is not true for secondary GPUs / slave outputs. This revert fixes the dgpu no longer suspending on laptops with switchable graphics after an external output which is connected to the dgpu has been used. And it fixes the WARN_ON to detect drm_framebuffer leaks in drm_mode_config_cleanup() triggering when unplugging an USB displaylink device; or when rmmod-ing the secondary GPU kms driver on laptops with switchable-graphics. Also this part of the reverted commit's commit-msg: "The old fb_id is zero'd, so there's no danger of being able to restore the fb from fb_id." is no longer true, the zero-ing does not happen until drm_framebuffer_free gets called, which does not happen until the last ref is dropped, so if a crtc's primary->fb is still pointing to this fb, the id will not get zero'd and userspace could potentially gain access to the removed fb again. Cc: stable@vger.kenrel.org Signed-off-by: Hans de Goede --- drivers/gpu/drm/drm_crtc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index e08f962..15f5cd7 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -3474,7 +3474,7 @@ int drm_mode_rmfb(struct drm_device *dev, mutex_unlock(&dev->mode_config.fb_lock); mutex_unlock(&file_priv->fbs_lock); - drm_framebuffer_unreference(fb); + drm_framebuffer_remove(fb); return 0; @@ -3656,8 +3656,8 @@ void drm_fb_release(struct drm_file *priv) list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) { list_del_init(&fb->filp_head); - /* This drops the fpriv->fbs reference. */ - drm_framebuffer_unreference(fb); + /* This will also drop the fpriv->fbs reference. */ + drm_framebuffer_remove(fb); } }