[v2 PATCH 2/3] drm/mediatek: Fix pkt buf alloc once but free many times

[jason-jh . lin]

Because mtk_drm_crt_cmdq_pkt_create is called once
in mtk_drm_crtc_create, the pkt should not be destroy
at ddp_cmdq_cb.

So move mtk_drm_crtc_pkt_destroy to mtk_drm_crtc_destroy.

Fixes: bc9241be73d9 ("drm/mediatek: Add cmdq_handle in mtk_crtc")
Signed-off-by: jason-jh.lin <jason-jh....@mediatek.com>
Reviewed-by: Chun-Kuang Hu <chunkuang...@kernel.org>
---
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 29 +++++++++++++++----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c 
b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index 411d99fcbb8f..274e5c67507d 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -108,12 +108,30 @@ static void mtk_drm_finish_page_flip(struct mtk_drm_crtc 
*mtk_crtc)
        }
 }
 
+#if IS_REACHABLE(CONFIG_MTK_CMDQ)
+static void mtk_drm_cmdq_pkt_destroy(struct cmdq_pkt *pkt)
+{
+       struct cmdq_client *client = (struct cmdq_client *)pkt->cl;
+
+       dma_unmap_single(client->chan->mbox->dev, pkt->pa_base, pkt->buf_size,
+                        DMA_TO_DEVICE);
+       kfree(pkt->va_base);
+       kfree(pkt);
+}
+#endif
+
 static void mtk_drm_crtc_destroy(struct drm_crtc *crtc)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
 
        mtk_mutex_put(mtk_crtc->mutex);
+#if IS_REACHABLE(CONFIG_MTK_CMDQ)
+       mtk_drm_cmdq_pkt_destroy(&mtk_crtc->cmdq_handle);
 
+       if (mtk_crtc->cmdq_client.chan)
+               mbox_free_channel(mtk_crtc->cmdq_client.chan);
+                                 mtk_crtc->cmdq_client.chan = NULL;
+#endif
        drm_crtc_cleanup(crtc);
 }
 
@@ -255,16 +273,6 @@ static int mtk_drm_cmdq_pkt_create(struct cmdq_client 
*client, struct cmdq_pkt *
        return 0;
 }
 
-static void mtk_drm_cmdq_pkt_destroy(struct cmdq_pkt *pkt)
-{
-       struct cmdq_client *client = (struct cmdq_client *)pkt->cl;
-
-       dma_unmap_single(client->chan->mbox->dev, pkt->pa_base, pkt->buf_size,
-                        DMA_TO_DEVICE);
-       kfree(pkt->va_base);
-       kfree(pkt);
-}
-
 static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
 {
        struct cmdq_cb_data *data = mssg;
@@ -302,7 +310,6 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
        }
 
        mtk_crtc->cmdq_vblank_cnt = 0;
-       mtk_drm_cmdq_pkt_destroy(data->pkt);
 }
 #endif
 
-- 
2.18.0