xf86-video-amdgpu: Branch 'master' - 2 commits

[Michel Dänzer]

 src/amdgpu_kms.c      |    8 ++++----
 src/drmmode_display.c |    8 ++++++--
 src/drmmode_display.h |   28 ++++++++++++++++------------
 3 files changed, 26 insertions(+), 18 deletions(-)

New commits:
commit 1b6ff5fd9933c00ec1ec90dfc62e0b531927749b
Author: Michel Dänzer <michel.daenzer at amd.com>
Date:   Thu Jun 22 16:27:32 2017 +0900

    Improve drmmode_fb_reference debugging code
    
    If a reference count is <= 0, call FatalError with the call location
    (in case it doesn't get resolved in the backtrace printed by
    FatalError).
    
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/src/drmmode_display.h b/src/drmmode_display.h
index b64a938..f351bb0 100644
--- a/src/drmmode_display.h
+++ b/src/drmmode_display.h
@@ -133,32 +133,36 @@ enum drmmode_flip_sync {
 
 
 static inline void
-drmmode_fb_reference(int drm_fd, struct drmmode_fb **old, struct drmmode_fb *new)
+drmmode_fb_reference_loc(int drm_fd, struct drmmode_fb **old, struct drmmode_fb *new,
+			 const char *caller, unsigned line)
 {
 	if (new) {
 		if (new->refcnt <= 0) {
-			ErrorF("New FB's refcnt was %d in %s\n", new->refcnt,
-			       __func__);
-		} else {
-			new->refcnt++;
+			FatalError("New FB's refcnt was %d at %s:%u",
+				   new->refcnt, caller, line);
 		}
+
+		new->refcnt++;
 	}
 
 	if (*old) {
 		if ((*old)->refcnt <= 0) {
-			ErrorF("Old FB's refcnt was %d in %s\n",
-			       (*old)->refcnt, __func__);
-		} else {
-			if (--(*old)->refcnt == 0) {
-				drmModeRmFB(drm_fd, (*old)->handle);
-				free(*old);
-			}
+			FatalError("Old FB's refcnt was %d at %s:%u",
+				   (*old)->refcnt, caller, line);
+		}
+
+		if (--(*old)->refcnt == 0) {
+			drmModeRmFB(drm_fd, (*old)->handle);
+			free(*old);
 		}
 	}
 
 	*old = new;
 }
 
+#define drmmode_fb_reference(fd, old, new) \
+	drmmode_fb_reference_loc(fd, old, new, __func__, __LINE__)
+
 
 extern int drmmode_page_flip_target_absolute(AMDGPUEntPtr pAMDGPUEnt,
 					     drmmode_crtc_private_ptr drmmode_crtc,
commit af7221e1c4d2dbdfd488eb0976a835584ea8441c
Author: Michel Dänzer <michel.daenzer at amd.com>
Date:   Wed Jun 21 19:01:54 2017 +0900

    Increase reference count of FB assigned to drmmode_crtc->flip_pending
    
    Otherwise, it could happen that we destroy the FB before the flip
    completes, resulting in use-after-free and most likely a crash.
    
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/src/amdgpu_kms.c b/src/amdgpu_kms.c
index 784f738..143294a 100644
--- a/src/amdgpu_kms.c
+++ b/src/amdgpu_kms.c
@@ -722,8 +722,8 @@ amdgpu_prime_scanout_flip(PixmapDirtyUpdatePtr ent)
 		return;
 	}
 
-	drmmode_crtc->flip_pending =
-		amdgpu_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap);
+	drmmode_fb_reference(pAMDGPUEnt->fd, &drmmode_crtc->flip_pending,
+			     amdgpu_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap));
 	if (!drmmode_crtc->flip_pending) {
 		xf86DrvMsg(scrn->scrnIndex, X_WARNING,
 			   "Failed to get FB for PRIME flip.\n");
@@ -1011,8 +1011,8 @@ amdgpu_scanout_flip(ScreenPtr pScreen, AMDGPUInfoPtr info,
 		return;
 	}
 
-	drmmode_crtc->flip_pending =
-		amdgpu_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap);
+	drmmode_fb_reference(pAMDGPUEnt->fd, &drmmode_crtc->flip_pending,
+			     amdgpu_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap));
 	if (!drmmode_crtc->flip_pending) {
 		xf86DrvMsg(scrn->scrnIndex, X_WARNING,
 			   "Failed to get FB for scanout flip.\n");
diff --git a/src/drmmode_display.c b/src/drmmode_display.c
index 0d90041..ce46f7b 100644
--- a/src/drmmode_display.c
+++ b/src/drmmode_display.c
@@ -2196,8 +2196,11 @@ void
 drmmode_clear_pending_flip(xf86CrtcPtr crtc)
 {
 	drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
+	ScrnInfoPtr scrn = crtc->scrn;
+	AMDGPUEntPtr pAMDGPUEnt = AMDGPUEntPriv(scrn);
 
-	drmmode_crtc->flip_pending = NULL;
+	drmmode_fb_reference(pAMDGPUEnt->fd, &drmmode_crtc->flip_pending,
+			     NULL);
 
 	if (!crtc->enabled ||
 	    (drmmode_crtc->pending_dpms_mode != DPMSModeOn &&
@@ -2835,7 +2838,8 @@ Bool amdgpu_do_pageflip(ScrnInfoPtr scrn, ClientPtr client,
 				goto flip_error;
 		}
 
-		drmmode_crtc->flip_pending = fb;
+		drmmode_fb_reference(pAMDGPUEnt->fd, &drmmode_crtc->flip_pending,
+				     fb);
 		drm_queue_seq = 0;
 	}