xf86-video-ati: Branch 'master' - 2 commits

[Michel Dänzer]

 src/drmmode_display.c |    8 ++++++--
 src/drmmode_display.h |   29 ++++++++++++++++++-----------
 src/radeon_kms.c      |    8 ++++----
 3 files changed, 28 insertions(+), 17 deletions(-)

New commits:
commit 19626bce4e5e31c863eedb503ea3884ac3f60bea
Author: Michel Dänzer <michel.daenzer at amd.com>
Date:   Tue Jun 27 18:32:28 2017 +0900

    Improve drmmode_fb_reference debugging code
    
    If a reference count is <= 0, call FatalError with the call location
    (in case it doesn't get resolved in the backtrace printed by
    FatalError).
    
    (Ported from amdgpu commit 1b6ff5fd9933c00ec1ec90dfc62e0b531927749b)
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/src/drmmode_display.h b/src/drmmode_display.h
index db68054a..dde27a00 100644
--- a/src/drmmode_display.h
+++ b/src/drmmode_display.h
@@ -141,29 +141,36 @@ enum drmmode_flip_sync {
 
 
 static inline void
-drmmode_fb_reference(int drm_fd, struct drmmode_fb **old, struct drmmode_fb *new)
+drmmode_fb_reference_loc(int drm_fd, struct drmmode_fb **old, struct drmmode_fb *new,
+			 const char *caller, unsigned line)
 {
     if (new) {
-	if (new->refcnt <= 0)
-	    ErrorF("New FB's refcnt was %d in %s\n", new->refcnt, __func__);
-	else
-	    new->refcnt++;
+	if (new->refcnt <= 0) {
+	    FatalError("New FB's refcnt was %d at %s:%u",
+		       new->refcnt, caller, line);
+	}
+
+	new->refcnt++;
     }
 
     if (*old) {
 	if ((*old)->refcnt <= 0) {
-	    ErrorF("Old FB's refcnt was %d in %s\n", (*old)->refcnt, __func__);
-	} else {
-	    if (--(*old)->refcnt == 0) {
-		drmModeRmFB(drm_fd, (*old)->handle);
-		free(*old);
-	    }
+	    FatalError("Old FB's refcnt was %d at %s:%u",
+		       (*old)->refcnt, caller, line);
+	}
+
+	if (--(*old)->refcnt == 0) {
+	    drmModeRmFB(drm_fd, (*old)->handle);
+	    free(*old);
 	}
     }
 
     *old = new;
 }
 
+#define drmmode_fb_reference(fd, old, new) \
+    drmmode_fb_reference_loc(fd, old, new, __func__, __LINE__)
+
 
 extern int drmmode_page_flip_target_absolute(RADEONEntPtr pRADEONEnt,
 					     drmmode_crtc_private_ptr drmmode_crtc,
commit bc46ffdf71ab3dfa0f95572529e818f2b619d380
Author: Michel Dänzer <michel.daenzer at amd.com>
Date:   Tue Jun 27 18:19:31 2017 +0900

    Increase reference count of FB assigned to drmmode_crtc->flip_pending
    
    Otherwise, it could happen that we destroy the FB before the flip
    completes, resulting in use-after-free and most likely a crash.
    
    (Ported from amdgpu commit af7221e1c4d2dbdfd488eb0976a835584ea8441c)
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/src/drmmode_display.c b/src/drmmode_display.c
index 9deaa575..dd394ec1 100644
--- a/src/drmmode_display.c
+++ b/src/drmmode_display.c
@@ -2369,8 +2369,11 @@ void
 drmmode_clear_pending_flip(xf86CrtcPtr crtc)
 {
 	drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
+	ScrnInfoPtr scrn = crtc->scrn;
+	RADEONEntPtr pRADEONEnt = RADEONEntPriv(scrn);
 
-	drmmode_crtc->flip_pending = NULL;
+	drmmode_fb_reference(pRADEONEnt->fd, &drmmode_crtc->flip_pending,
+			     NULL);
 
 	if (!crtc->enabled ||
 	    (drmmode_crtc->pending_dpms_mode != DPMSModeOn &&
@@ -3030,7 +3033,8 @@ Bool radeon_do_pageflip(ScrnInfoPtr scrn, ClientPtr client,
 				goto flip_error;
 		}
 
-		drmmode_crtc->flip_pending = fb;
+		drmmode_fb_reference(pRADEONEnt->fd, &drmmode_crtc->flip_pending,
+				     fb);
 		drm_queue_seq = 0;
 	}
 
diff --git a/src/radeon_kms.c b/src/radeon_kms.c
index 5637e7f8..691fcdf5 100644
--- a/src/radeon_kms.c
+++ b/src/radeon_kms.c
@@ -815,8 +815,8 @@ radeon_prime_scanout_flip(PixmapDirtyUpdatePtr ent)
 	return;
     }
 
-    drmmode_crtc->flip_pending =
-	radeon_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap);
+    drmmode_fb_reference(pRADEONEnt->fd, &drmmode_crtc->flip_pending,
+			  radeon_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap));
     if (!drmmode_crtc->flip_pending) {
 	xf86DrvMsg(scrn->scrnIndex, X_WARNING,
 		   "Failed to get FB for PRIME flip.\n");
@@ -1110,8 +1110,8 @@ radeon_scanout_flip(ScreenPtr pScreen, RADEONInfoPtr info,
 	return;
     }
 
-    drmmode_crtc->flip_pending =
-	radeon_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap);
+    drmmode_fb_reference(pRADEONEnt->fd, &drmmode_crtc->flip_pending,
+			  radeon_pixmap_get_fb(drmmode_crtc->scanout[scanout_id].pixmap));
     if (!drmmode_crtc->flip_pending) {
 	xf86DrvMsg(scrn->scrnIndex, X_WARNING,
 		   "Failed to get FB for scanout flip.\n");