Commit e1fc82a3 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2021-07-15' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes 



Short summary of fixes pull (less than what git shortlog provides):

 * fbdev: Avoid use-after-free by not deleting current video mode
 * ttm: Avoid NULL-ptr deref in ttm_range_man_fini()
 * vmwgfx: Fix a merge commit

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/YO/yoFO+iSEqnIH0@linux-uq9g
parents 2ea2086c 9e5c7729

drivers/gpu/drm/qxl/qxl_ttm.c

+1 −1
Original line number Diff line number Diff line
@@ -127,7 +127,7 @@ static void qxl_bo_move_notify(struct ttm_buffer_object *bo, 
	struct qxl_bo *qbo;

	struct qxl_device *qdev;



	if (!qxl_ttm_bo_is_qxl_bo(bo))

	if (!qxl_ttm_bo_is_qxl_bo(bo) || !bo->resource)

		return;

	qbo = to_qxl_bo(bo);

	qdev = to_qxl(qbo->tbo.base.dev);

drivers/gpu/drm/ttm/ttm_range_manager.c

+3 −0
Original line number Diff line number Diff line
@@ -181,6 +181,9 @@ int ttm_range_man_fini(struct ttm_device *bdev, 
	struct drm_mm *mm = &rman->mm;

	int ret;



	if (!man)

		return 0;



	ttm_resource_manager_set_used(man, false);



	ret = ttm_resource_manager_evict_all(bdev, man);

drivers/gpu/drm/vmwgfx/vmwgfx_drv.c

+1 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ 
#include <drm/drm_ioctl.h>

#include <drm/drm_sysfs.h>

#include <drm/ttm/ttm_bo_driver.h>

#include <drm/ttm/ttm_range_manager.h>

#include <drm/ttm/ttm_placement.h>

#include <generated/utsrelease.h>

drivers/gpu/drm/vmwgfx/vmwgfx_mob.c

+0 −1
Original line number Diff line number Diff line
@@ -354,7 +354,6 @@ static void vmw_otable_batch_takedown(struct vmw_private *dev_priv, 
	ttm_bo_unpin(bo);

	ttm_bo_unreserve(bo);



	ttm_bo_unpin(batch->otable_bo);

	ttm_bo_put(batch->otable_bo);

	batch->otable_bo = NULL;

}

drivers/video/fbdev/core/fbmem.c

+5 −7
Original line number Diff line number Diff line
@@ -970,13 +970,11 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) 
		fb_var_to_videomode(&mode2, &info->var);

		/* make sure we don't delete the videomode of current var */

		ret = fb_mode_is_equal(&mode1, &mode2);



		if (!ret)

			fbcon_mode_deleted(info, &mode1);



		if (!ret) {

			ret = fbcon_mode_deleted(info, &mode1);

			if (!ret)

				fb_delete_videomode(&mode1, &info->modelist);



		}



		return ret ? -EINVAL : 0;

	}