From: Xiaojie Yuan <Xiaojie.Yuan@amd.com>
Date: Tue, 4 Jul 2017 14:21:58 +0800
Subject: drm/amd/display: Fix misuse of plane state destroy helper
Git-commit: a67297d4c8d0bfac39a0fa166e98dcf54db1d7c2
Patch-mainline: v4.15-rc1
References: FATE#326289 FATE#326079 FATE#326049 FATE#322398 FATE#326166

drm_plane_state is subclassed by dm_plane_state, so atomic driver should
use __drm_atomic_helper_plane_destroy_state() to destroy a state.
drm_atomic_helper_plane_destroy_state() frees drm_plane_state which is
allocated inside dm_plane_state, this is problematic.

Fixes: 95ae03a ("drm/amd/display: Create dm_plane_state.")
Signed-off-by: Xiaojie Yuan <Xiaojie.Yuan@amd.com>
Reviewed-by: Andrey Grodzovsky <Andrey.Grodzovsky@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Acked-by: Petr Tesarik <ptesarik@suse.com>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_types.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_types.c
@@ -1431,7 +1431,8 @@ void dm_drm_plane_destroy_state(struct d
 		dc_surface_release(dc_surface);
 	}
 
-	drm_atomic_helper_plane_destroy_state(plane, state);
+	__drm_atomic_helper_plane_destroy_state(state);
+	kfree(dm_plane_state);
 }
 
 static const struct drm_plane_funcs dm_plane_funcs = {