Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Ayan Kumar Halder <ayan.halder@arm.com>
To:     ayan.halder@arm.com, liviu.dudau@arm.com, brian.starkey@arm.com,
        linux@armlinux.org.uk, airlied@linux.ie,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
        alexandru-cosmin.gheorghe@arm.com
Cc:     nd@arm.com
Subject: [PATCH] tda998x: Check ref count before invoking drm_connector_cleanup in unbind
Date:   Thu, 12 Apr 2018 15:42:32 +0100
Message-Id: <1523544152-15241-1-git-send-email-ayan.halder@arm.com>
MIME-Version: 1.0
Content-Type: text/plain
NoDisclaimer: True
Received-SPF: None (protection.outlook.com: arm.com does not designate
 permitted sender hosts)
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Apr 2018 14:42:42.1276 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 130f9a7b-9fbb-4c4b-bcbe-08d5a083a5b0
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3026
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

In a situation when the reference count of the drm connector is greater than 1,
the unbind function should not invoke drm_connector_cleanup as this will lead
to an inconsistent state where the drm_crtc_state->connector_mask still has
a bitmask referring to the stale connector. Later, when drm driver invokes
drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
 ---> drm_atomic_commit() --> drm_atomic_check_only() -->
drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
an error due to enabled/connectors mismatch.

In such a scenario, one should just return from _unbind() and let the drm driver
subsequently invoke drm_atomic_helper_shutdown. This will reset the
drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
will get invoked which will do the following :-

1. Decrement the reference count for each of the connectors. Thus the ref count
will reach 0 and drm_connector_funcs->destroy() gets called. Thus,
tda998x_connector_destroy() gets invoked which calls drm_connector_cleanup

2. Invokes the destroy callback for each encoder. Thus tda998x_encoder_destroy()
gets invoked.

Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com>
---
 drivers/gpu/drm/i2c/tda998x_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 9e67a7b..8ad1cc7 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -1709,6 +1709,9 @@ static void tda998x_unbind(struct device *dev, struct device *master,
 {
 	struct tda998x_priv *priv = dev_get_drvdata(dev);
 
+	if (kref_read(&priv->connector.base.refcount) > 1)
+		return;
+
 	drm_connector_cleanup(&priv->connector);
 	drm_encoder_cleanup(&priv->encoder);
 	tda998x_destroy(priv);
-- 
2.7.4