From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Sat, 18 Sep 2010 18:19:49 +0000 (-0700)
Subject: .32 patches
X-Git-Tag: v2.6.27.54~6
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=78aea9a1207dd144dddc98c62e1a4392340def45;p=thirdparty%2Fkernel%2Fstable-queue.git

.32 patches
---

diff --git a/queue-2.6.32/drm-only-decouple-the-old_fb-from-the-crtc-is-we-call-mode_set.patch b/queue-2.6.32/drm-only-decouple-the-old_fb-from-the-crtc-is-we-call-mode_set.patch
new file mode 100644
index 00000000000..d14be6eeab2
--- /dev/null
+++ b/queue-2.6.32/drm-only-decouple-the-old_fb-from-the-crtc-is-we-call-mode_set.patch
@@ -0,0 +1,42 @@
+From 356ad3cd616185631235ffb48b3efbf39f9923b3 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 9 Sep 2010 09:41:32 +0100
+Subject: drm: Only decouple the old_fb from the crtc is we call mode_set*
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 356ad3cd616185631235ffb48b3efbf39f9923b3 upstream.
+
+Otherwise when disabling the output we switch to the new fb (which is
+likely NULL) and skip the call to mode_set -- leaking driver private
+state on the old_fb.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29857
+Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_crtc_helper.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_crtc_helper.c
++++ b/drivers/gpu/drm/drm_crtc_helper.c
+@@ -925,13 +925,13 @@ int drm_crtc_helper_set_config(struct dr
+ 		mode_changed = true;
+ 
+ 	if (mode_changed) {
+-		old_fb = set->crtc->fb;
+-		set->crtc->fb = set->fb;
+ 		set->crtc->enabled = (set->mode != NULL);
+ 		if (set->mode != NULL) {
+ 			DRM_DEBUG_KMS("attempting to set mode from"
+ 					" userspace\n");
+ 			drm_mode_debug_printmodeline(set->mode);
++			old_fb = set->crtc->fb;
++			set->crtc->fb = set->fb;
+ 			if (!drm_crtc_helper_set_mode(set->crtc, set->mode,
+ 						      set->x, set->y,
+ 						      old_fb)) {
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index 1c35fec3d8a..7b64287ddbc 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -120,3 +120,4 @@ sunrpc-fix-race-corrupting-rpc-upcall.patch
 i915-return-efault-if-copy_to_user-fails.patch
 i915-return-efault-if-copy_to_user-fails-2.patch
 drm-i915-prevent-double-dpms-on.patch
+drm-only-decouple-the-old_fb-from-the-crtc-is-we-call-mode_set.patch