From patchwork Fri Jan 16 15:25:24 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matt Roper X-Patchwork-Id: 5649201 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 0F678C058D for ; Fri, 16 Jan 2015 15:25:57 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 33DAC202EC for ; Fri, 16 Jan 2015 15:25:56 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 48CF3202A1 for ; Fri, 16 Jan 2015 15:25:55 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C94F36E2D0; Fri, 16 Jan 2015 07:25:54 -0800 (PST) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTP id 9F19D6E2CA for ; Fri, 16 Jan 2015 07:25:53 -0800 (PST) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga101.jf.intel.com with ESMTP; 16 Jan 2015 07:25:53 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.09,411,1418112000"; d="scan'208";a="662992456" Received: from mdroper-hswdev.fm.intel.com (HELO mdroper-hswdev) ([10.1.134.215]) by fmsmga002.fm.intel.com with ESMTP; 16 Jan 2015 07:25:53 -0800 Received: from mattrope by mdroper-hswdev with local (Exim 4.82) (envelope-from ) id 1YC8mX-0002Wz-0u; Fri, 16 Jan 2015 07:25:53 -0800 From: Matt Roper To: intel-gfx@lists.freedesktop.org Date: Fri, 16 Jan 2015 07:25:24 -0800 Message-Id: <1421421924-9697-1-git-send-email-matthew.d.roper@intel.com> X-Mailer: git-send-email 1.8.5.1 Subject: [Intel-gfx] [PATCH] drm/i915: Don't cleanup plane state in intel_plane_destroy() X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When we transitioned to the atomic plane helpers in commit: commit ea2c67bb4affa84080c616920f3899f123786e56 Author: Matt Roper Date: Tue Dec 23 10:41:52 2014 -0800 drm/i915: Move to atomic plane helpers (v9) one of the changes was to call intel_plane_destroy_state() while tearing down a plane to prevent leaks when unloading the driver. That made sense when the patches were first written, but before they were merged, commit 3009c0377f25c29852b218a6933a969d02cbdc5d Author: Thierry Reding Date: Tue Nov 25 12:09:49 2014 +0100 drm: Free atomic state during cleanup had already landed, which made this the responsibility of the DRM core. The result was that we were kfree()'ing the state twice, and also possibly double-unref'ing a framebuffer, leading to memory corruption when the driver was unloaded. The fix is to simply not try to cleanup the state in the i915 teardown code now that the core handles this for us. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88433 Testcase: igt/drv_module_reload Root-cause-analysis-by: Ander Conselvan de Oliveira Signed-off-by: Matt Roper Reviewed-by: Jani Nikula Tested-By: PRC QA PRTS (Patch Regression Test System Contact: shuang.he@intel.com) --- drivers/gpu/drm/i915/intel_display.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 91d8ada..cc3b9d8 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -11937,7 +11937,6 @@ static void intel_finish_crtc_commit(struct drm_crtc *crtc) void intel_plane_destroy(struct drm_plane *plane) { struct intel_plane *intel_plane = to_intel_plane(plane); - intel_plane_destroy_state(plane, plane->state); drm_plane_cleanup(plane); kfree(intel_plane); }