Commit 29f95f20 authored by Daniel Vetter's avatar Daniel Vetter
Browse files

Merge tag 'drm-misc-fixes-2021-01-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes 



* dma-buf: fix a use-after-free
* radeon: don't init the TTM page pool manually
* ttm: unexport ttm_pool_{init,fini}()

Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/X/gnKs52t8xUuAlE@linux-uq9g
parents 25ea8ecf a73858ef

drivers/dma-buf/dma-buf.c

+17 −4
Original line number Diff line number Diff line
@@ -76,10 +76,6 @@ static void dma_buf_release(struct dentry *dentry) 


	dmabuf->ops->release(dmabuf);



	mutex_lock(&db_list.lock);

	list_del(&dmabuf->list_node);

	mutex_unlock(&db_list.lock);



	if (dmabuf->resv == (struct dma_resv *)&dmabuf[1])

		dma_resv_fini(dmabuf->resv);
@@ -88,6 +84,22 @@ static void dma_buf_release(struct dentry *dentry) 
	kfree(dmabuf);

}



static int dma_buf_file_release(struct inode *inode, struct file *file)

{

	struct dma_buf *dmabuf;



	if (!is_dma_buf_file(file))

		return -EINVAL;



	dmabuf = file->private_data;



	mutex_lock(&db_list.lock);

	list_del(&dmabuf->list_node);

	mutex_unlock(&db_list.lock);



	return 0;

}



static const struct dentry_operations dma_buf_dentry_ops = {

	.d_dname = dmabuffs_dname,

	.d_release = dma_buf_release,
@@ -413,6 +425,7 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file) 
}



static const struct file_operations dma_buf_fops = {

	.release	= dma_buf_file_release,

	.mmap		= dma_buf_mmap_internal,

	.llseek		= dma_buf_llseek,

	.poll		= dma_buf_poll,

drivers/gpu/drm/radeon/radeon_ttm.c

+0 −3
Original line number Diff line number Diff line
@@ -730,9 +730,6 @@ int radeon_ttm_init(struct radeon_device *rdev) 
	}

	rdev->mman.initialized = true;



	ttm_pool_init(&rdev->mman.bdev.pool, rdev->dev, rdev->need_swiotlb,

		      dma_addressing_limited(&rdev->pdev->dev));



	r = radeon_ttm_init_vram(rdev);

	if (r) {

		DRM_ERROR("Failed initializing VRAM heap.\n");

drivers/gpu/drm/ttm/ttm_pool.c

+0 −2
Original line number Diff line number Diff line
@@ -507,7 +507,6 @@ void ttm_pool_init(struct ttm_pool *pool, struct device *dev, 
			ttm_pool_type_init(&pool->caching[i].orders[j],

					   pool, i, j);

}

EXPORT_SYMBOL(ttm_pool_init);



/**

 * ttm_pool_fini - Cleanup a pool
@@ -525,7 +524,6 @@ void ttm_pool_fini(struct ttm_pool *pool) 
		for (j = 0; j < MAX_ORDER; ++j)

			ttm_pool_type_fini(&pool->caching[i].orders[j]);

}

EXPORT_SYMBOL(ttm_pool_fini);



#ifdef CONFIG_DEBUG_FS

/* Count the number of pages available in a pool_type */