Commit 437eccb1 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2026-03-19' of... 

Merge tag 'drm-misc-fixes-2026-03-19' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

A doc warning fix and a memory leak fix for vmwgfx, a deadlock fix and
interrupt handling fixes for imagination, a locking fix for
pagemap_until, a UAF fix for drm_dev_unplug, and a multi-channel audio
handling fix for dw-hdmi-qp.

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20260319-lush-righteous-malamute-e7bb98@houat
parents d551d2e8 cffcb42c

drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c

+1 −1
Original line number Diff line number Diff line
@@ -848,7 +848,7 @@ static int dw_hdmi_qp_config_audio_infoframe(struct dw_hdmi_qp *hdmi, 


	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS0, &header_bytes, 1);

	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS1, &buffer[3], 1);

	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS2, &buffer[4], 1);

	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS2, &buffer[7], 1);



	/* Enable ACR, AUDI, AMD */

	dw_hdmi_qp_mod(hdmi,

drivers/gpu/drm/drm_file.c

+4 −1
Original line number Diff line number Diff line
@@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv) 
void drm_file_free(struct drm_file *file)

{

	struct drm_device *dev;

	int idx;



	if (!file)

		return;
@@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file) 


	drm_events_release(file);



	if (drm_core_check_feature(dev, DRIVER_MODESET)) {

	if (drm_core_check_feature(dev, DRIVER_MODESET) &&

	    drm_dev_enter(dev, &idx)) {

		drm_fb_release(file);

		drm_property_destroy_user_blobs(dev, file);

		drm_dev_exit(idx);

	}



	if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))

drivers/gpu/drm/drm_mode_config.c

+6 −3
Original line number Diff line number Diff line
@@ -577,10 +577,13 @@ void drm_mode_config_cleanup(struct drm_device *dev) 
	 */

	WARN_ON(!list_empty(&dev->mode_config.fb_list));

	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {

		if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {

			struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");



			drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);

			drm_framebuffer_print_info(&p, 1, fb);

		}

		list_del_init(&fb->filp_head);

		drm_framebuffer_free(&fb->base.refcount);

	}

drivers/gpu/drm/drm_pagemap_util.c

+5 −9
Original line number Diff line number Diff line
@@ -65,18 +65,14 @@ static void drm_pagemap_cache_fini(void *arg) 
	drm_dbg(cache->shrinker->drm, "Destroying dpagemap cache.\n");

	spin_lock(&cache->lock);

	dpagemap = cache->dpagemap;

	if (!dpagemap) {

		spin_unlock(&cache->lock);

		goto out;

	}



	if (drm_pagemap_shrinker_cancel(dpagemap)) {

	cache->dpagemap = NULL;

	if (dpagemap && !drm_pagemap_shrinker_cancel(dpagemap))

		dpagemap = NULL;

	spin_unlock(&cache->lock);



	if (dpagemap)

		drm_pagemap_destroy(dpagemap, false);

	}



out:

	mutex_destroy(&cache->lookup_mutex);

	kfree(cache);

}

drivers/gpu/drm/imagination/pvr_device.c

+0 −17
Original line number Diff line number Diff line
@@ -225,29 +225,12 @@ static irqreturn_t pvr_device_irq_thread_handler(int irq, void *data) 
	}



	if (pvr_dev->has_safety_events) {

		int err;



		/*

		 * Ensure the GPU is powered on since some safety events (such

		 * as ECC faults) can happen outside of job submissions, which

		 * are otherwise the only time a power reference is held.

		 */

		err = pvr_power_get(pvr_dev);

		if (err) {

			drm_err_ratelimited(drm_dev,

					    "%s: could not take power reference (%d)\n",

					    __func__, err);

			return ret;

		}



		while (pvr_device_safety_irq_pending(pvr_dev)) {

			pvr_device_safety_irq_clear(pvr_dev);

			pvr_device_handle_safety_events(pvr_dev);



			ret = IRQ_HANDLED;

		}



		pvr_power_put(pvr_dev);

	}



	return ret;