drm/gma500/cdv: Fix cursor gem obj referencing on cdv

The internal crtc cursor gem object pointer was never set/updated since
it was required to be set in the first place.

Fixing this will make the pin/unpin count match and prevent cursor
objects from leaking when userspace drops all references to it. Also
make sure we drop the gem obj reference on failure.

This patch only affects Cedarview chips.

Signed-off-by: Patrik Jakobsson <[email protected]>

diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c
index d6742dcc911dca9acaa26330d995d4c1078e0ea5..82430ad8ba623934fd74a3f12059c5d180c92fae 100644 (file)
--- a/drivers/gpu/drm/gma500/cdv_intel_display.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_display.c
@@ -1462,7 +1462,7 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
        size_t addr = 0;
        struct gtt_range *gt;
        struct drm_gem_object *obj;
        size_t addr = 0;
        struct gtt_range *gt;
        struct drm_gem_object *obj;

-       int ret;
+       int ret = 0;

 
        /* if we want to turn of the cursor ignore width and height */
        if (!handle) {
 
        /* if we want to turn of the cursor ignore width and height */
        if (!handle) {


@@ -1499,7 +1499,8 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
 
        if (obj->size < width * height * 4) {
                dev_dbg(dev->dev, "buffer is to small\n");
 
        if (obj->size < width * height * 4) {
                dev_dbg(dev->dev, "buffer is to small\n");

-               return -ENOMEM;
+               ret = -ENOMEM;
+               goto unref_cursor;

        }
 
        gt = container_of(obj, struct gtt_range, gem);
        }
 
        gt = container_of(obj, struct gtt_range, gem);


@@ -1508,7 +1509,7 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
        ret = psb_gtt_pin(gt);
        if (ret) {
                dev_err(dev->dev, "Can not pin down handle 0x%x\n", handle);
        ret = psb_gtt_pin(gt);
        if (ret) {
                dev_err(dev->dev, "Can not pin down handle 0x%x\n", handle);

-               return ret;
+               goto unref_cursor;

        }
 
        addr = gt->offset;      /* Or resource.start ??? */
        }
 
        addr = gt->offset;      /* Or resource.start ??? */


@@ -1532,9 +1533,14 @@ static int cdv_intel_crtc_cursor_set(struct drm_crtc *crtc,
                                                        struct gtt_range, gem);
                psb_gtt_unpin(gt);
                drm_gem_object_unreference(psb_intel_crtc->cursor_obj);
                                                        struct gtt_range, gem);
                psb_gtt_unpin(gt);
                drm_gem_object_unreference(psb_intel_crtc->cursor_obj);

-               psb_intel_crtc->cursor_obj = obj;

        }
        }

-       return 0;
+
+       psb_intel_crtc->cursor_obj = obj;
+       return ret;
+
+unref_cursor:
+       drm_gem_object_unreference(obj);
+       return ret;

 }
 
 static int cdv_intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
 }
 
 static int cdv_intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)