Commit 3a390a21 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2026-01-29' of... 

Merge tag 'drm-misc-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

drm-misc-fixes for v6.19-rc8:
- Fix a WARN_ON() when passing an invalid handle to
  drm_gem_change_handle_ioctl()
- drop ddc device reference when unloading in imx/tve.

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/a34d967e-b111-4b29-8c97-af3e77b5d33e@linux.intel.com
parents 016bf668 e535c235

drivers/gpu/drm/drm_gem.c

+12 −6
Original line number Diff line number Diff line
@@ -960,16 +960,21 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, 
{

	struct drm_gem_change_handle *args = data;

	struct drm_gem_object *obj;

	int ret;

	int handle, ret;



	if (!drm_core_check_feature(dev, DRIVER_GEM))

		return -EOPNOTSUPP;



	/* idr_alloc() limitation. */

	if (args->new_handle > INT_MAX)

		return -EINVAL;

	handle = args->new_handle;



	obj = drm_gem_object_lookup(file_priv, args->handle);

	if (!obj)

		return -ENOENT;



	if (args->handle == args->new_handle) {

	if (args->handle == handle) {

		ret = 0;

		goto out;

	}
@@ -977,18 +982,19 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, 
	mutex_lock(&file_priv->prime.lock);



	spin_lock(&file_priv->table_lock);

	ret = idr_alloc(&file_priv->object_idr, obj,

		args->new_handle, args->new_handle + 1, GFP_NOWAIT);

	ret = idr_alloc(&file_priv->object_idr, obj, handle, handle + 1,

			GFP_NOWAIT);

	spin_unlock(&file_priv->table_lock);



	if (ret < 0)

		goto out_unlock;



	if (obj->dma_buf) {

		ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf, args->new_handle);

		ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,

					       handle);

		if (ret < 0) {

			spin_lock(&file_priv->table_lock);

			idr_remove(&file_priv->object_idr, args->new_handle);

			idr_remove(&file_priv->object_idr, handle);

			spin_unlock(&file_priv->table_lock);

			goto out_unlock;

		}

drivers/gpu/drm/imx/ipuv3/imx-tve.c

+13 −0
Original line number Diff line number Diff line
@@ -528,6 +528,13 @@ static const struct component_ops imx_tve_ops = { 
	.bind	= imx_tve_bind,

};



static void imx_tve_put_device(void *_dev)

{

	struct device *dev = _dev;



	put_device(dev);

}



static int imx_tve_probe(struct platform_device *pdev)

{

	struct device *dev = &pdev->dev;
@@ -549,6 +556,12 @@ static int imx_tve_probe(struct platform_device *pdev) 
	if (ddc_node) {

		tve->ddc = of_find_i2c_adapter_by_node(ddc_node);

		of_node_put(ddc_node);

		if (tve->ddc) {

			ret = devm_add_action_or_reset(dev, imx_tve_put_device,

						       &tve->ddc->dev);

			if (ret)

				return ret;

		}

	}



	tve->mode = of_get_tve_mode(np);