Commit 1298a549 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2020-07-02' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes 



 * dma-buf: fix a use-after-free bug

 * sun4i: remove HPD polling

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20200702075143.GA25040@linux-uq9g
parents 80e89901 bda8eaa6

drivers/dma-buf/dma-buf.c

+25 −29
Original line number Diff line number Diff line
@@ -54,37 +54,11 @@ static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen) 
			     dentry->d_name.name, ret > 0 ? name : "");

}



static const struct dentry_operations dma_buf_dentry_ops = {

	.d_dname = dmabuffs_dname,

};



static struct vfsmount *dma_buf_mnt;



static int dma_buf_fs_init_context(struct fs_context *fc)

{

	struct pseudo_fs_context *ctx;



	ctx = init_pseudo(fc, DMA_BUF_MAGIC);

	if (!ctx)

		return -ENOMEM;

	ctx->dops = &dma_buf_dentry_ops;

	return 0;

}



static struct file_system_type dma_buf_fs_type = {

	.name = "dmabuf",

	.init_fs_context = dma_buf_fs_init_context,

	.kill_sb = kill_anon_super,

};



static int dma_buf_release(struct inode *inode, struct file *file)

static void dma_buf_release(struct dentry *dentry)

{

	struct dma_buf *dmabuf;



	if (!is_dma_buf_file(file))

		return -EINVAL;



	dmabuf = file->private_data;

	dmabuf = dentry->d_fsdata;



	BUG_ON(dmabuf->vmapping_counter);
@@ -110,9 +84,32 @@ static int dma_buf_release(struct inode *inode, struct file *file) 
	module_put(dmabuf->owner);

	kfree(dmabuf->name);

	kfree(dmabuf);

}



static const struct dentry_operations dma_buf_dentry_ops = {

	.d_dname = dmabuffs_dname,

	.d_release = dma_buf_release,

};



static struct vfsmount *dma_buf_mnt;



static int dma_buf_fs_init_context(struct fs_context *fc)

{

	struct pseudo_fs_context *ctx;



	ctx = init_pseudo(fc, DMA_BUF_MAGIC);

	if (!ctx)

		return -ENOMEM;

	ctx->dops = &dma_buf_dentry_ops;

	return 0;

}



static struct file_system_type dma_buf_fs_type = {

	.name = "dmabuf",

	.init_fs_context = dma_buf_fs_init_context,

	.kill_sb = kill_anon_super,

};



static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)

{

	struct dma_buf *dmabuf;
@@ -412,7 +409,6 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file) 
}



static const struct file_operations dma_buf_fops = {

	.release	= dma_buf_release,

	.mmap		= dma_buf_mmap_internal,

	.llseek		= dma_buf_llseek,

	.poll		= dma_buf_poll,

drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c

+2 −3
Original line number Diff line number Diff line
@@ -259,9 +259,8 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force) 
	struct sun4i_hdmi *hdmi = drm_connector_to_sun4i_hdmi(connector);

	unsigned long reg;



	if (readl_poll_timeout(hdmi->base + SUN4I_HDMI_HPD_REG, reg,

			       reg & SUN4I_HDMI_HPD_HIGH,

			       0, 500000)) {

	reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);

	if (reg & SUN4I_HDMI_HPD_HIGH) {

		cec_phys_addr_invalidate(hdmi->cec_adap);

		return connector_status_disconnected;

	}