Commit 685f27c1 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-next-fixes-2025-12-10' of... 

Merge tag 'drm-misc-next-fixes-2025-12-10' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-next

drm-misc-next-fixes for v6.19-rc1:
- Fix uaf in panthor.
- Revert 8 byte alignment constraint for pitch in dumb bo's.
- Fix DRM_MODE_FLAG_N.SYNC and !DRM_MODE_FLAG_P.SYNC handling renasas.

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/a82c2a2a-314f-403b-85bf-9b3ee09b903c@linux.intel.com
parents c7685d11 308eeb8c

drivers/gpu/drm/drm_gem_dma_helper.c

+1 −1
Original line number Diff line number Diff line
@@ -308,7 +308,7 @@ int drm_gem_dma_dumb_create(struct drm_file *file_priv, 
	struct drm_gem_dma_object *dma_obj;

	int ret;



	ret = drm_mode_size_dumb(drm, args, SZ_8, 0);

	ret = drm_mode_size_dumb(drm, args, 0, 0);

	if (ret)

		return ret;

drivers/gpu/drm/drm_gem_shmem_helper.c

+1 −1
Original line number Diff line number Diff line
@@ -559,7 +559,7 @@ int drm_gem_shmem_dumb_create(struct drm_file *file, struct drm_device *dev, 
{

	int ret;



	ret = drm_mode_size_dumb(dev, args, SZ_8, 0);

	ret = drm_mode_size_dumb(dev, args, 0, 0);

	if (ret)

		return ret;

drivers/gpu/drm/panthor/panthor_sched.c

+15 −4
Original line number Diff line number Diff line
@@ -779,6 +779,12 @@ struct panthor_job_profiling_data { 
 */

#define MAX_GROUPS_PER_POOL 128



/*

 * Mark added on an entry of group pool Xarray to identify if the group has

 * been fully initialized and can be accessed elsewhere in the driver code.

 */

#define GROUP_REGISTERED XA_MARK_1



/**

 * struct panthor_group_pool - Group pool

 *
@@ -3007,7 +3013,7 @@ void panthor_fdinfo_gather_group_samples(struct panthor_file *pfile) 
		return;



	xa_lock(&gpool->xa);

	xa_for_each(&gpool->xa, i, group) {

	xa_for_each_marked(&gpool->xa, i, group, GROUP_REGISTERED) {

		guard(spinlock)(&group->fdinfo.lock);

		pfile->stats.cycles += group->fdinfo.data.cycles;

		pfile->stats.time += group->fdinfo.data.time;
@@ -3727,6 +3733,8 @@ int panthor_group_create(struct panthor_file *pfile, 


	group_init_task_info(group);



	xa_set_mark(&gpool->xa, gid, GROUP_REGISTERED);



	return gid;



err_erase_gid:
@@ -3744,6 +3752,9 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle) 
	struct panthor_scheduler *sched = ptdev->scheduler;

	struct panthor_group *group;



	if (!xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED))

		return -EINVAL;



	group = xa_erase(&gpool->xa, group_handle);

	if (!group)

		return -EINVAL;
@@ -3769,12 +3780,12 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle) 
}



static struct panthor_group *group_from_handle(struct panthor_group_pool *pool,

					       u32 group_handle)

					       unsigned long group_handle)

{

	struct panthor_group *group;



	xa_lock(&pool->xa);

	group = group_get(xa_load(&pool->xa, group_handle));

	group = group_get(xa_find(&pool->xa, &group_handle, group_handle, GROUP_REGISTERED));

	xa_unlock(&pool->xa);



	return group;
@@ -3861,7 +3872,7 @@ panthor_fdinfo_gather_group_mem_info(struct panthor_file *pfile, 
		return;



	xa_lock(&gpool->xa);

	xa_for_each(&gpool->xa, i, group) {

	xa_for_each_marked(&gpool->xa, i, group, GROUP_REGISTERED) {

		stats->resident += group->fdinfo.kbo_sizes;

		if (group->csg_id >= 0)

			stats->active += group->fdinfo.kbo_sizes;

drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c

+2 −2
Original line number Diff line number Diff line
@@ -492,9 +492,9 @@ static void rcar_mipi_dsi_set_display_timing(struct rcar_mipi_dsi *dsi, 


	/* Configuration for Video Parameters, input is always RGB888 */

	vprmset0r = TXVMVPRMSET0R_BPP_24;

	if (mode->flags & DRM_MODE_FLAG_NVSYNC)

	if (!(mode->flags & DRM_MODE_FLAG_PVSYNC))

		vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW;

	if (mode->flags & DRM_MODE_FLAG_NHSYNC)

	if (!(mode->flags & DRM_MODE_FLAG_PHSYNC))

		vprmset0r |= TXVMVPRMSET0R_HSPOL_LOW;



	vprmset1r = TXVMVPRMSET1R_VACTIVE(mode->vdisplay)