This change updates the old_fb pointer only after acquiring the plane lock,
if there are no properties the fb cannot have been changed either, so
this works out correctly.
Found in a discussion with Rob Clark.
Cc: Rob Clark <robdclark@gmail.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
                        goto fail;
                }
 
-               if (obj->type == DRM_MODE_OBJECT_PLANE) {
-                       plane = obj_to_plane(obj);
-                       plane_mask |= (1 << drm_plane_index(plane));
-                       plane->old_fb = plane->fb;
-               }
-
                if (get_user(count_props, count_props_ptr + copied_objs)) {
                        ret = -EFAULT;
                        goto fail;
 
                        copied_props++;
                }
+
+               if (obj->type == DRM_MODE_OBJECT_PLANE && count_props) {
+                       plane = obj_to_plane(obj);
+                       plane_mask |= (1 << drm_plane_index(plane));
+                       plane->old_fb = plane->fb;
+               }
        }
 
        if (arg->flags & DRM_MODE_PAGE_FLIP_EVENT) {