Commit 71d9e156 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2026-05-21' of... 

Merge tag 'drm-misc-fixes-2026-05-21' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

Short summary of fixes pull:

amdxdna:
- remove mmap and export for ubuf

bridge:
- chipone-icn6211: managed bridge cleanup
- lt66121: acquire reset GPIO
- megachips: fix clean up on failed IRQ requests

gem:
- clean up LRU locking

v3d:
- fix UAF in error code paths
- release GEM-object ref on free'd jobs

virtio:
- use uninterruptible resv locking in plane updates

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260521071456.GA14644@localhost.localdomain
parents aee43aaf 9af1b6e1

drivers/accel/amdxdna/amdxdna_gem.c

+8 −1
Original line number Diff line number Diff line
@@ -490,6 +490,9 @@ static struct dma_buf *amdxdna_gem_prime_export(struct drm_gem_object *gobj, int 
	struct amdxdna_gem_obj *abo = to_xdna_obj(gobj);

	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);



	if (abo->private_buffer)

		return ERR_PTR(-EOPNOTSUPP);



	if (abo->dma_buf) {

		get_dma_buf(abo->dma_buf);

		return abo->dma_buf;
@@ -685,6 +688,7 @@ amdxdna_gem_create_ubuf_object(struct drm_device *dev, struct amdxdna_drm_create 
{

	struct amdxdna_dev *xdna = to_xdna_dev(dev);

	struct amdxdna_drm_va_tbl va_tbl;

	struct amdxdna_gem_obj *abo;

	struct drm_gem_object *gobj;

	struct dma_buf *dma_buf;
@@ -711,7 +715,10 @@ amdxdna_gem_create_ubuf_object(struct drm_device *dev, struct amdxdna_drm_create 


	dma_buf_put(dma_buf);



	return to_xdna_obj(gobj);

	abo = to_xdna_obj(gobj);

	abo->private_buffer = true;



	return abo;

}



struct drm_gem_object *

drivers/accel/amdxdna/amdxdna_gem.h

+2 −0
Original line number Diff line number Diff line
@@ -54,6 +54,8 @@ struct amdxdna_gem_obj { 


	/* True, if BO is managed by XRT, not application */

	bool				internal;

	/* True, if BO is not exportable */

	bool				private_buffer;

};



#define to_gobj(obj)    (&(obj)->base.base)

drivers/accel/amdxdna/amdxdna_ubuf.c

+0 −50
Original line number Diff line number Diff line
@@ -69,60 +69,10 @@ static void amdxdna_ubuf_release(struct dma_buf *dbuf) 
	kfree(ubuf);

}



static vm_fault_t amdxdna_ubuf_vm_fault(struct vm_fault *vmf)

{

	struct vm_area_struct *vma = vmf->vma;

	struct amdxdna_ubuf_priv *ubuf;

	unsigned long pfn;

	pgoff_t pgoff;



	ubuf = vma->vm_private_data;

	pgoff = (vmf->address - vma->vm_start) >> PAGE_SHIFT;



	pfn = page_to_pfn(ubuf->pages[pgoff]);

	return vmf_insert_pfn(vma, vmf->address, pfn);

}



static const struct vm_operations_struct amdxdna_ubuf_vm_ops = {

	.fault = amdxdna_ubuf_vm_fault,

};



static int amdxdna_ubuf_mmap(struct dma_buf *dbuf, struct vm_area_struct *vma)

{

	struct amdxdna_ubuf_priv *ubuf = dbuf->priv;



	vma->vm_ops = &amdxdna_ubuf_vm_ops;

	vma->vm_private_data = ubuf;

	vm_flags_set(vma, VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);



	return 0;

}



static int amdxdna_ubuf_vmap(struct dma_buf *dbuf, struct iosys_map *map)

{

	struct amdxdna_ubuf_priv *ubuf = dbuf->priv;

	void *kva;



	kva = vmap(ubuf->pages, ubuf->nr_pages, VM_MAP, PAGE_KERNEL);

	if (!kva)

		return -EINVAL;



	iosys_map_set_vaddr(map, kva);

	return 0;

}



static void amdxdna_ubuf_vunmap(struct dma_buf *dbuf, struct iosys_map *map)

{

	vunmap(map->vaddr);

}



static const struct dma_buf_ops amdxdna_ubuf_dmabuf_ops = {

	.map_dma_buf = amdxdna_ubuf_map,

	.unmap_dma_buf = amdxdna_ubuf_unmap,

	.release = amdxdna_ubuf_release,

	.mmap = amdxdna_ubuf_mmap,

	.vmap = amdxdna_ubuf_vmap,

	.vunmap = amdxdna_ubuf_vunmap,

};



struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev,

drivers/gpu/drm/bridge/chipone-icn6211.c

+3 −1
Original line number Diff line number Diff line
@@ -758,7 +758,9 @@ static int chipone_i2c_probe(struct i2c_client *client) 
	dev_set_drvdata(dev, icn);

	i2c_set_clientdata(client, icn);



	drm_bridge_add(&icn->bridge);

	ret = devm_drm_bridge_add(dev, &icn->bridge);

	if (ret)

		return ret;



	return chipone_dsi_host_attach(icn);

}

drivers/gpu/drm/bridge/ite-it66121.c

+5 −0
Original line number Diff line number Diff line
@@ -1559,6 +1559,11 @@ static int it66121_probe(struct i2c_client *client) 
		return ret;

	}



	ctx->gpio_reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);

	if (IS_ERR(ctx->gpio_reset))

		return dev_err_probe(dev, PTR_ERR(ctx->gpio_reset),

				     "Failed to get reset GPIO\n");



	it66121_hw_reset(ctx);



	ctx->regmap = devm_regmap_init_i2c(client, &it66121_regmap_config);