Am Montag, den 13.06.2016, 20:18 +0200 schrieb Daniel Vetter: [...]
Only the reference count of connectors that weren't previously bound to an encoder should be incremented after a call to drm_crtc_helper_set_config. And only the reference count of connectors that were previously bound to an encoder and are unbound afterwards should ever be decremented. The reference counts of the temporary copies in the save_connectors should not be touched at all.
This patch fixes the above error by only incrementing the reference count of those connectors in the set that are initially not bound to any encoder, and also by restoring the reference count of only those connectors in the set in the failure case.
Fixes: 0955c1250e96 ("drm/crtc: take references to connectors used in a modeset. (v2)") Signed-off-by: Philipp Zabel p.zabel@pengutronix.de
I'd like to analyze this bug first a bit more (since it seems to be imx specific) before review/merging, per our ongoing discussion. The current code is definitely wrong, but looking at it I more expected a leak (since we decrement saved structures, not the real ones), not an explosion. -Daniel
There is a regression bug open against nouveau, which shows the same symptoms and is fixed by these patches.
https://bugzilla.kernel.org/show_bug.cgi?id=119861
It is not specific to imx-drm, but doesn't explode on desktop system right away, probably due to the FB emulation holding a reference to all connectors.
Sensible theory. Can you confirm that enabling fbdev emulation on imx works around this?
Yes, we are unable to reproduce the issue if fbdev emulation is enabled.
Regards, Lucas