drm/i915: Keep plane->state updated on pageflip

Until all drivers have transitioned to atomic, the framebuffer
associated with a plane is tracked in both plane->fb (for legacy) and
plane->state->fb (for all the new atomic codeflow).  All of our modeset
and plane updates use drm_plane->update_plane(), so in theory plane->fb
and plane->state->fb should always stay in sync and point at the same
thing for i915.  However we forgot about the pageflip ioctl case, which
currently only updates plane->fb and leaves plane->state->fb at a stale
value.

Surprisingly, this doesn't cause any real problems at the moment since
internally we use the plane->fb pointer in most of the places that
matter, and on the next .update_plane() call, we use plane->fb to figure
out which framebuffer to cleanup.  However when we switch to the full
atomic helpers for update_plane()/disable_plane(), those helpers use
plane->state->fb to figure out which framebuffer to cleanup, so not
having updated the plane->state->fb pointer causes things to blow up
following a pageflip ioctl.

The fix here is to just make sure we update plane->state->fb at the same
time we update plane->fb in the pageflip ioctl.
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

drivers/gpu/drm/i915/intel_display.c

@@ -9801,6 +9801,13 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
 
 	crtc->primary->fb = fb;
 
+	/* Keep state structure in sync */
+	if (crtc->primary->state->fb)
+		drm_framebuffer_unreference(crtc->primary->state->fb);
+	crtc->primary->state->fb = fb;
+	if (crtc->primary->state->fb)
+		drm_framebuffer_reference(crtc->primary->state->fb);
+
 	work->pending_flip_obj = obj;
 
 	atomic_inc(&intel_crtc->unpin_work_count);