Commit b91e11ec authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2025-07-03' of... 

Merge tag 'drm-misc-fixes-2025-07-03' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

drm-misc-fixes for v6.16-rc5:
- Replace simple panel lookup hack with proper fix.
- nullpointer deref in vesadrm fix.
- fix dma_resv_wait_timeout.
- fix error handling in ttm_buffer_object_transfer.
- bridge fixes.
- Fix vmwgfx accidentally allocating encrypted memory.
- Fix race in spsc_queue_push()
- Add refcount on backing GEM objects during fb creation.
- Fix v3d irq's being enabled during gpu reset.

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://lore.kernel.org/r/a7461418-08dc-4b7c-b2fa-264155f66d5e@linux.intel.com
parents bf906c98 226862f5

drivers/dma-buf/dma-resv.c

+7 −5
Original line number Diff line number Diff line
@@ -685,11 +685,13 @@ long dma_resv_wait_timeout(struct dma_resv *obj, enum dma_resv_usage usage, 
	dma_resv_iter_begin(&cursor, obj, usage);

	dma_resv_for_each_fence_unlocked(&cursor, fence) {



		ret = dma_fence_wait_timeout(fence, intr, ret);

		if (ret <= 0) {

			dma_resv_iter_end(&cursor);

			return ret;

		}

		ret = dma_fence_wait_timeout(fence, intr, timeout);

		if (ret <= 0)

			break;



		/* Even for zero timeout the return value is 1 */

		if (timeout)

			timeout = ret;

	}

	dma_resv_iter_end(&cursor);

drivers/gpu/drm/bridge/aux-hpd-bridge.c

+2 −1
Original line number Diff line number Diff line
@@ -64,10 +64,11 @@ struct auxiliary_device *devm_drm_dp_hpd_bridge_alloc(struct device *parent, str 
	adev->id = ret;

	adev->name = "dp_hpd_bridge";

	adev->dev.parent = parent;

	adev->dev.of_node = of_node_get(parent->of_node);

	adev->dev.release = drm_aux_hpd_bridge_release;

	adev->dev.platform_data = of_node_get(np);



	device_set_of_node_from_dev(&adev->dev, parent);



	ret = auxiliary_device_init(adev);

	if (ret) {

		of_node_put(adev->dev.platform_data);

drivers/gpu/drm/bridge/panel.c

+1 −4
Original line number Diff line number Diff line
@@ -299,6 +299,7 @@ struct drm_bridge *drm_panel_bridge_add_typed(struct drm_panel *panel, 
	panel_bridge->bridge.of_node = panel->dev->of_node;

	panel_bridge->bridge.ops = DRM_BRIDGE_OP_MODES;

	panel_bridge->bridge.type = connector_type;

	panel_bridge->bridge.pre_enable_prev_first = panel->prepare_prev_first;



	drm_bridge_add(&panel_bridge->bridge);
@@ -413,8 +414,6 @@ struct drm_bridge *devm_drm_panel_bridge_add_typed(struct device *dev, 
		return bridge;

	}



	bridge->pre_enable_prev_first = panel->prepare_prev_first;



	*ptr = bridge;

	devres_add(dev, ptr);
@@ -456,8 +455,6 @@ struct drm_bridge *drmm_panel_bridge_add(struct drm_device *drm, 
	if (ret)

		return ERR_PTR(ret);



	bridge->pre_enable_prev_first = panel->prepare_prev_first;



	return bridge;

}

EXPORT_SYMBOL(drmm_panel_bridge_add);

drivers/gpu/drm/drm_gem.c

+40 −4
Original line number Diff line number Diff line
@@ -212,6 +212,35 @@ void drm_gem_private_object_fini(struct drm_gem_object *obj) 
}

EXPORT_SYMBOL(drm_gem_private_object_fini);



static void drm_gem_object_handle_get(struct drm_gem_object *obj)

{

	struct drm_device *dev = obj->dev;



	drm_WARN_ON(dev, !mutex_is_locked(&dev->object_name_lock));



	if (obj->handle_count++ == 0)

		drm_gem_object_get(obj);

}



/**

 * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles

 * @obj: GEM object

 *

 * Acquires a reference on the GEM buffer object's handle. Required

 * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()

 * to release the reference.

 */

void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)

{

	struct drm_device *dev = obj->dev;



	guard(mutex)(&dev->object_name_lock);



	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */

	drm_gem_object_handle_get(obj);

}

EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);



/**

 * drm_gem_object_handle_free - release resources bound to userspace handles

 * @obj: GEM object to clean up.
@@ -242,8 +271,14 @@ static void drm_gem_object_exported_dma_buf_free(struct drm_gem_object *obj) 
	}

}



static void

drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj)

/**

 * drm_gem_object_handle_put_unlocked - releases reference on user-space handles

 * @obj: GEM object

 *

 * Releases a reference on the GEM buffer object's handle. Possibly releases

 * the GEM buffer object and associated dma-buf objects.

 */

void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj)

{

	struct drm_device *dev = obj->dev;

	bool final = false;
@@ -268,6 +303,7 @@ drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj) 
	if (final)

		drm_gem_object_put(obj);

}

EXPORT_SYMBOL(drm_gem_object_handle_put_unlocked);



/*

 * Called at device or object close to release the file's
@@ -389,8 +425,8 @@ drm_gem_handle_create_tail(struct drm_file *file_priv, 
	int ret;



	WARN_ON(!mutex_is_locked(&dev->object_name_lock));

	if (obj->handle_count++ == 0)

		drm_gem_object_get(obj);



	drm_gem_object_handle_get(obj);



	/*

	 * Get the user-visible handle using idr.  Preload and perform

drivers/gpu/drm/drm_gem_framebuffer_helper.c

+9 −7
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ void drm_gem_fb_destroy(struct drm_framebuffer *fb) 
	unsigned int i;



	for (i = 0; i < fb->format->num_planes; i++)

		drm_gem_object_put(fb->obj[i]);

		drm_gem_object_handle_put_unlocked(fb->obj[i]);



	drm_framebuffer_cleanup(fb);

	kfree(fb);
@@ -182,8 +182,10 @@ int drm_gem_fb_init_with_funcs(struct drm_device *dev, 
		if (!objs[i]) {

			drm_dbg_kms(dev, "Failed to lookup GEM object\n");

			ret = -ENOENT;

			goto err_gem_object_put;

			goto err_gem_object_handle_put_unlocked;

		}

		drm_gem_object_handle_get_unlocked(objs[i]);

		drm_gem_object_put(objs[i]);



		min_size = (height - 1) * mode_cmd->pitches[i]

			 + drm_format_info_min_pitch(info, i, width)
@@ -193,22 +195,22 @@ int drm_gem_fb_init_with_funcs(struct drm_device *dev, 
			drm_dbg_kms(dev,

				    "GEM object size (%zu) smaller than minimum size (%u) for plane %d\n",

				    objs[i]->size, min_size, i);

			drm_gem_object_put(objs[i]);

			drm_gem_object_handle_put_unlocked(objs[i]);

			ret = -EINVAL;

			goto err_gem_object_put;

			goto err_gem_object_handle_put_unlocked;

		}

	}



	ret = drm_gem_fb_init(dev, fb, mode_cmd, objs, i, funcs);

	if (ret)

		goto err_gem_object_put;

		goto err_gem_object_handle_put_unlocked;



	return 0;



err_gem_object_put:

err_gem_object_handle_put_unlocked:

	while (i > 0) {

		--i;

		drm_gem_object_put(objs[i]);

		drm_gem_object_handle_put_unlocked(objs[i]);

	}

	return ret;

}