Commit 366a9295 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2025-09-25' of... 

Merge tag 'drm-misc-fixes-2025-09-25' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

A CPU stall fix for ast, a NULL pointer dereference fix for gma500, an
OOB and overflow fixes for fbcon, and a race condition fix for panthor.

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://lore.kernel.org/r/20250925-smilodon-of-luxurious-genius-4ebee7@penduick
parents 4d486a51 7d9c3442

drivers/gpu/drm/ast/ast_dp.c

+1 −1
Original line number Diff line number Diff line
@@ -134,7 +134,7 @@ static int ast_astdp_read_edid_block(void *data, u8 *buf, unsigned int block, si 
			 * 3. The Delays are often longer a lot when system resume from S3/S4.

			 */

			if (j)

				mdelay(j + 1);

				msleep(j + 1);



			/* Wait for EDID offset to show up in mirror register */

			vgacrd7 = ast_get_index_reg(ast, AST_IO_VGACRI, 0xd7);

drivers/gpu/drm/gma500/oaktrail_hdmi.c

+1 −1
Original line number Diff line number Diff line
@@ -726,8 +726,8 @@ void oaktrail_hdmi_teardown(struct drm_device *dev) 


	if (hdmi_dev) {

		pdev = hdmi_dev->dev;

		pci_set_drvdata(pdev, NULL);

		oaktrail_hdmi_i2c_exit(pdev);

		pci_set_drvdata(pdev, NULL);

		iounmap(hdmi_dev->regs);

		kfree(hdmi_dev);

		pci_dev_put(pdev);

drivers/gpu/drm/panthor/panthor_sched.c

+1 −7
Original line number Diff line number Diff line
@@ -886,7 +886,6 @@ static void group_free_queue(struct panthor_group *group, struct panthor_queue * 
	if (IS_ERR_OR_NULL(queue))

		return;



	if (queue->entity.fence_context)

	drm_sched_entity_destroy(&queue->entity);



	if (queue->scheduler.ops)
@@ -3558,11 +3557,6 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle) 
	if (!group)

		return -EINVAL;



	for (u32 i = 0; i < group->queue_count; i++) {

		if (group->queues[i])

			drm_sched_entity_destroy(&group->queues[i]->entity);

	}



	mutex_lock(&sched->reset.lock);

	mutex_lock(&sched->lock);

	group->destroyed = true;

drivers/video/fbdev/core/fbcon.c

+10 −3
Original line number Diff line number Diff line
@@ -2504,7 +2504,7 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font, 
	unsigned charcount = font->charcount;

	int w = font->width;

	int h = font->height;

	int size;

	int size, alloc_size;

	int i, csum;

	u8 *new_data, *data = font->data;

	int pitch = PITCH(font->width);
@@ -2531,9 +2531,16 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font, 
	if (fbcon_invalid_charcount(info, charcount))

		return -EINVAL;



	size = CALC_FONTSZ(h, pitch, charcount);

	/* Check for integer overflow in font size calculation */

	if (check_mul_overflow(h, pitch, &size) ||

	    check_mul_overflow(size, charcount, &size))

		return -EINVAL;



	/* Check for overflow in allocation size calculation */

	if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size))

		return -EINVAL;



	new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);

	new_data = kmalloc(alloc_size, GFP_USER);



	if (!new_data)

		return -ENOMEM;