Commit 17dd4d44 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-rust-fixes-2026-05-07' of... 

Merge tag 'drm-rust-fixes-2026-05-07' of https://gitlab.freedesktop.org/drm/rust/kernel

 into drm-fixes

DRM Rust fixes for v7.1-rc3

- Fix unsound initialization in drm::Device::new(); if pinned
  initialization of drm::Device::Data fails, make sure
  drm::Device::release() isn't called, so we don't run the data's
  destructor

- Fix missing GEM state cleanup in the init failure case; call
  drm_gem_private_object_fini() if drm_gem_object_init() fails

- Fix wrong ARef import in the DRM shmem GEM helper abstraction

- Replace the nouveau mailing list with the new nova-gpu mailing list
  for both nova-core and nova-drm, and remove unused patchwork entries

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: "Danilo Krummrich" <dakr@kernel.org>
Link: https://patch.msgid.link/DIBZJ40ZC4J3.Y1DLA7JTS2PC@kernel.org
parents 2c5d5ecd 0a69ac25

MAINTAINERS

+2 −4
Original line number Diff line number Diff line
@@ -8193,10 +8193,9 @@ F: include/uapi/drm/nouveau_drm.h 
CORE DRIVER FOR NVIDIA GPUS [RUST]

M:	Danilo Krummrich <dakr@kernel.org>

M:	Alexandre Courbot <acourbot@nvidia.com>

L:	nouveau@lists.freedesktop.org

L:	nova-gpu@lists.linux.dev

S:	Supported

W:	https://rust-for-linux.com/nova-gpu-driver

Q:	https://patchwork.freedesktop.org/project/nouveau/

B:	https://gitlab.freedesktop.org/drm/nova/-/issues

C:	irc://irc.oftc.net/nouveau

T:	git https://gitlab.freedesktop.org/drm/rust/kernel.git drm-rust-next
@@ -8205,10 +8204,9 @@ F: drivers/gpu/nova-core/ 








DRM DRIVER FOR NVIDIA GPUS [RUST]









M:	Danilo Krummrich <dakr@kernel.org>









L:	nouveau@lists.freedesktop.org









L:	nova-gpu@lists.linux.dev









S:	Supported









W:	https://rust-for-linux.com/nova-gpu-driver









Q:	https://patchwork.freedesktop.org/project/nouveau/









B:	https://gitlab.freedesktop.org/drm/nova/-/issues









C:	irc://irc.oftc.net/nouveau









T:	git https://gitlab.freedesktop.org/drm/rust/kernel.git drm-rust-next
































rust/kernel/drm/device.rs



+16
−6






























Original line number
Diff line number
Diff line







@@ -119,13 +119,20 @@ pub fn new(dev: &device::Device, data: impl PinInit<T::Data, Error>) -> Result<A







        // compatible `Layout`.









        let layout = Kmalloc::aligned_layout(Layout::new::<Self>());



















        // Use a temporary vtable without a `release` callback until `data` is initialized, so









        // init failure can release the DRM device without dropping uninitialized fields.









        let alloc_vtable = bindings::drm_driver {









            release: None,









            ..Self::VTABLE









        };



















        // SAFETY:









        // - `VTABLE`, as a `const` is pinned to the read-only section of the compilation,









        // - `alloc_vtable` reference remains valid until no longer used,









        // - `dev` is valid by its type invarants,









        let raw_drm: *mut Self = unsafe {









            bindings::__drm_dev_alloc(









                dev.as_raw(),









                &Self::VTABLE,









                &alloc_vtable,









                layout.size(),









                mem::offset_of!(Self, dev),









            )








@@ -133,6 +140,10 @@ pub fn new(dev: &device::Device, data: impl PinInit<T::Data, Error>) -> Result<A







        .cast();









        let raw_drm = NonNull::new(from_err_ptr(raw_drm)?).ok_or(ENOMEM)?;



















        // SAFETY: `raw_drm` is a valid pointer to `Self`, given that `__drm_dev_alloc` was









        // successful.









        let drm_dev = unsafe { Self::into_drm_device(raw_drm) };



















        // SAFETY: `raw_drm` is a valid pointer to `Self`.









        let raw_data = unsafe { ptr::addr_of_mut!((*raw_drm.as_ptr()).data) };


















@@ -140,15 +151,14 @@ pub fn new(dev: &device::Device, data: impl PinInit<T::Data, Error>) -> Result<A







        // - `raw_data` is a valid pointer to uninitialized memory.









        // - `raw_data` will not move until it is dropped.









        unsafe { data.__pinned_init(raw_data) }.inspect_err(|_| {









            // SAFETY: `raw_drm` is a valid pointer to `Self`, given that `__drm_dev_alloc` was









            // successful.









            let drm_dev = unsafe { Self::into_drm_device(raw_drm) };



















            // SAFETY: `__drm_dev_alloc()` was successful, hence `drm_dev` must be valid and the









            // refcount must be non-zero.









            unsafe { bindings::drm_dev_put(drm_dev) };









        })?;



















        // SAFETY: `drm_dev` is still private to this function.









        unsafe { (*drm_dev).driver = const { &Self::VTABLE } };



















        // SAFETY: The reference count is one, and now we take ownership of that reference as a









        // `drm::Device`.









        Ok(unsafe { ARef::from_raw(raw_drm) })
































rust/kernel/drm/gem/mod.rs



+11
−2






























Original line number
Diff line number
Diff line







@@ -277,8 +277,17 @@ pub fn new(dev: &drm::Device<T::Driver>, size: usize, args: T::Args) -> Result<A







        // SAFETY: `obj.as_raw()` is guaranteed to be valid by the initialization above.









        unsafe { (*obj.as_raw()).funcs = &Self::OBJECT_FUNCS };



















        if let Err(err) =









            // SAFETY: The arguments are all valid per the type invariants.









        to_result(unsafe { bindings::drm_gem_object_init(dev.as_raw(), obj.obj.get(), size) })?;









            to_result(unsafe {









                bindings::drm_gem_object_init(dev.as_raw(), obj.obj.get(), size)









            })









        {









            // SAFETY: `drm_gem_object_init()` initializes the private GEM object state before









            // failing, so `drm_gem_private_object_fini()` is the matching cleanup.









            unsafe { bindings::drm_gem_private_object_fini(obj.obj.get()) };









            return Err(err);









        }



















        // SAFETY: We will never move out of `Self` as `ARef<Self>` is always treated as pinned.









        let ptr = KBox::into_raw(unsafe { Pin::into_inner_unchecked(obj) });
































rust/kernel/drm/gem/shmem.rs



+2
−4






























Original line number
Diff line number
Diff line







@@ -19,10 +19,8 @@







    },









    error::to_result,









    prelude::*,









    types::{









        ARef,









        Opaque, //









    }, //









    sync::aref::ARef,









    types::Opaque, //









};









use core::{









    ops::{