Commit 8ea2c518 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2022-02-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes 



 * dma-buf/heaps: Fix potential spectre v1 gadget
 * drm/kmb: Fix potential out-of-bounds access
 * drm/mxsfb: Fix NULL-pointer dereference
 * drm/nouveau: Fix potential out-of-bounds access in BIOS decoding
 * fbdev: Re-add support for fbcon hardware acceleration

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/Yfu8mTZQUNt1RwZd@linux-uq9g
parents 7eb3848c 622c9a3a

Documentation/gpu/todo.rst

+0 −24
Original line number Diff line number Diff line
@@ -300,30 +300,6 @@ Contact: Daniel Vetter, Noralf Tronnes 


Level: Advanced



Garbage collect fbdev scrolling acceleration

--------------------------------------------



Scroll acceleration has been disabled in fbcon. Now it works as the old

SCROLL_REDRAW mode. A ton of code was removed in fbcon.c and the hook bmove was

removed from fbcon_ops.

Remaining tasks:



- a bunch of the hooks in fbcon_ops could be removed or simplified by calling

  directly instead of the function table (with a switch on p->rotate)



- fb_copyarea is unused after this, and can be deleted from all drivers



- after that, fb_copyarea can be deleted from fb_ops in include/linux/fb.h as

  well as cfb_copyarea



Note that not all acceleration code can be deleted, since clearing and cursor

support is still accelerated, which might be good candidates for further

deletion projects.



Contact: Daniel Vetter



Level: Intermediate



idr_init_base()

---------------

drivers/dma-buf/dma-heap.c

+2 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <linux/xarray.h>

#include <linux/list.h>

#include <linux/slab.h>

#include <linux/nospec.h>

#include <linux/uaccess.h>

#include <linux/syscalls.h>

#include <linux/dma-heap.h>
@@ -135,6 +136,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd, 
	if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))

		return -EINVAL;



	nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds));

	/* Get the kernel ioctl cmd that matches */

	kcmd = dma_heap_ioctl_cmds[nr];

drivers/gpu/drm/kmb/kmb_plane.c

+0 −6
Original line number Diff line number Diff line
@@ -158,12 +158,6 @@ static void kmb_plane_atomic_disable(struct drm_plane *plane, 
	case LAYER_1:

		kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;

		break;

	case LAYER_2:

		kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;

		break;

	case LAYER_3:

		kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;

		break;

	}



	kmb->plane_status[plane_id].disable = true;

drivers/gpu/drm/mxsfb/mxsfb_kms.c

+5 −1
Original line number Diff line number Diff line
@@ -361,7 +361,11 @@ static void mxsfb_crtc_atomic_enable(struct drm_crtc *crtc, 
		bridge_state =

			drm_atomic_get_new_bridge_state(state,

							mxsfb->bridge);

		if (!bridge_state)

			bus_format = MEDIA_BUS_FMT_FIXED;

		else

			bus_format = bridge_state->input_bus_cfg.format;



		if (bus_format == MEDIA_BUS_FMT_FIXED) {

			dev_warn_once(drm->dev,

				      "Bridge does not provide bus format, assuming MEDIA_BUS_FMT_RGB888_1X24.\n"

drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c

+1 −1
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr, u8 size) 
		*addr += bios->imaged_addr;

	}



	if (unlikely(*addr + size >= bios->size)) {

	if (unlikely(*addr + size > bios->size)) {

		nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr);

		return false;

	}