Commit ec7f4961 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'drm-fixes-2022-05-14' of git://anongit.freedesktop.org/drm/drm 

Pull more drm fixes from Dave Airlie:
 "Turns out I was right, some fixes hadn't made it to me yet. The vmwgfx
  ones also popped up later, but all seem like bad enough things to fix.
  The dma-buf, vc4 and nouveau ones are all pretty small.

  The fbdev fixes are a bit more complicated: a fix to cleanup fbdev
  devices properly, uncovered some use-after-free bugs in existing
  drivers. Then the fix for those bugs wasn't correct. This reverts that
  fix, and puts the proper fixes in place in the drivers to avoid the
  use-after-frees.

  This has had a fair number of eyes on it at this stage, and I'm
  confident enough that it puts things in the right place, and is less
  dangerous than reverting our way out of the initial change at this
  stage.

  fbdev:
   - revert NULL deref fix that turned into a use-after-free
   - prevent use-after-free in fbdev
   - efifb/simplefb/vesafb: fix cleanup paths to avoid use-after-frees

  dma-buf:
   - fix panic in stats setup

  vc4:
   - fix hdmi build

  nouveau:
   - tegra iommu present fix
   - fix leak in backlight name

  vmwgfx:
   - Black screen due to fences using FIFO checks on SVGA3
   - Random black screens on boot due to uninitialized drm_mode_fb_cmd2
   - Hangs on SVGA3 due to command buffers being used with gbobjects"

* tag 'drm-fixes-2022-05-14' of git://anongit.freedesktop.org/drm/drm:
  drm/vmwgfx: Disable command buffers on svga3 without gbobjects
  drm/vmwgfx: Initialize drm_mode_fb_cmd2
  drm/vmwgfx: Fix fencing on SVGAv3
  drm/vc4: hdmi: Fix build error for implicit function declaration
  dma-buf: call dma_buf_stats_setup after dmabuf is in valid list
  fbdev: efifb: Fix a use-after-free due early fb_info cleanup
  drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
  drm/nouveau/tegra: Stop using iommu_present()
  fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove
  fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove
  fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove
  fbdev: Prevent possible use-after-free in fb_release()
  Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered"
parents d928e8f3 eb7bac39

drivers/dma-buf/dma-buf.c

+4 −4
Original line number Diff line number Diff line
@@ -543,10 +543,6 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) 
	file->f_mode |= FMODE_LSEEK;

	dmabuf->file = file;



	ret = dma_buf_stats_setup(dmabuf);

	if (ret)

		goto err_sysfs;



	mutex_init(&dmabuf->lock);

	INIT_LIST_HEAD(&dmabuf->attachments);
@@ -554,6 +550,10 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) 
	list_add(&dmabuf->list_node, &db_list.head);

	mutex_unlock(&db_list.lock);



	ret = dma_buf_stats_setup(dmabuf);

	if (ret)

		goto err_sysfs;



	return dmabuf;



err_sysfs:

drivers/gpu/drm/nouveau/nouveau_backlight.c

+5 −4
Original line number Diff line number Diff line
@@ -46,8 +46,9 @@ static bool 
nouveau_get_backlight_name(char backlight_name[BL_NAME_SIZE],

			   struct nouveau_backlight *bl)

{

	const int nb = ida_simple_get(&bl_ida, 0, 0, GFP_KERNEL);

	if (nb < 0 || nb >= 100)

	const int nb = ida_alloc_max(&bl_ida, 99, GFP_KERNEL);



	if (nb < 0)

		return false;

	if (nb > 0)

		snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d", nb);
@@ -414,7 +415,7 @@ nouveau_backlight_init(struct drm_connector *connector) 
					    nv_encoder, ops, &props);

	if (IS_ERR(bl->dev)) {

		if (bl->id >= 0)

			ida_simple_remove(&bl_ida, bl->id);

			ida_free(&bl_ida, bl->id);

		ret = PTR_ERR(bl->dev);

		goto fail_alloc;

	}
@@ -442,7 +443,7 @@ nouveau_backlight_fini(struct drm_connector *connector) 
		return;



	if (bl->id >= 0)

		ida_simple_remove(&bl_ida, bl->id);

		ida_free(&bl_ida, bl->id);



	backlight_device_unregister(bl->dev);

	nv_conn->backlight = NULL;

drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c

+1 −1
Original line number Diff line number Diff line
@@ -123,7 +123,7 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) 


	mutex_init(&tdev->iommu.mutex);



	if (iommu_present(&platform_bus_type)) {

	if (device_iommu_mapped(dev)) {

		tdev->iommu.domain = iommu_domain_alloc(&platform_bus_type);

		if (!tdev->iommu.domain)

			goto error;

drivers/gpu/drm/vc4/vc4_hdmi.c

+1 −0
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
#include <drm/drm_scdc_helper.h>

#include <linux/clk.h>

#include <linux/component.h>

#include <linux/gpio/consumer.h>

#include <linux/i2c.h>

#include <linux/of_address.h>

#include <linux/of_gpio.h>

drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c

+8 −5
Original line number Diff line number Diff line
@@ -528,7 +528,7 @@ int vmw_cmd_send_fence(struct vmw_private *dev_priv, uint32_t *seqno) 
		*seqno = atomic_add_return(1, &dev_priv->marker_seq);

	} while (*seqno == 0);



	if (!(vmw_fifo_caps(dev_priv) & SVGA_FIFO_CAP_FENCE)) {

	if (!vmw_has_fences(dev_priv)) {



		/*

		 * Don't request hardware to send a fence. The
@@ -675,11 +675,14 @@ int vmw_cmd_emit_dummy_query(struct vmw_private *dev_priv, 
 */

bool vmw_cmd_supported(struct vmw_private *vmw)

{

	if ((vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS |

				  SVGA_CAP_CMD_BUFFERS_2)) != 0)

		return true;

	bool has_cmdbufs =

		(vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS |

				      SVGA_CAP_CMD_BUFFERS_2)) != 0;

	if (vmw_is_svga_v3(vmw))

		return (has_cmdbufs &&

			(vmw->capabilities & SVGA_CAP_GBOBJECTS) != 0);

	/*

	 * We have FIFO cmd's

	 */

	return vmw->fifo_mem != NULL;

	return has_cmdbufs || vmw->fifo_mem != NULL;

}