Commit 2f73503e authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2024-03-28' of... 

Merge tag 'drm-misc-fixes-2024-03-28' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

Short summary of fixes pull:

bridge:
- select DRM_KMS_HELPER

dma-buf:
- fix NULL-pointer deref

dp:
- fix div-by-zero in DP MST unplug code

fbdev:
- select FB_IOMEM_FOPS for SBus

nouveau:
- dmem: handle kcalloc() allocation failures

qxl:
- remove unused variables

rockchip:
- vop2: remove support for AR30 and AB30 formats

sched:
- fix NULL-pointer deref

vmwgfx:
- debugfs: create ttm_resource_manager entry only if needed

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20240328134417.GA8673@localhost.localdomain
parents 197aa825 aba2a144

drivers/dma-buf/st-dma-fence-chain.c

+3 −3
Original line number Diff line number Diff line
@@ -84,10 +84,10 @@ static int sanitycheck(void *arg) 
		return -ENOMEM;



	chain = mock_chain(NULL, f, 1);

	if (!chain)

		err = -ENOMEM;



	if (chain)

		dma_fence_enable_sw_signaling(chain);

	else

		err = -ENOMEM;



	dma_fence_signal(f);

	dma_fence_put(f);

drivers/gpu/drm/display/drm_dp_helper.c

+7 −0
Original line number Diff line number Diff line
@@ -4111,6 +4111,13 @@ int drm_dp_bw_overhead(int lane_count, int hactive, 
	u32 overhead = 1000000;

	int symbol_cycles;



	if (lane_count == 0 || hactive == 0 || bpp_x16 == 0) {

		DRM_DEBUG_KMS("Invalid BW overhead params: lane_count %d, hactive %d, bpp_x16 %d.%04d\n",

			      lane_count, hactive,

			      bpp_x16 >> 4, (bpp_x16 & 0xf) * 625);

		return 0;

	}



	/*

	 * DP Standard v2.1 2.6.4.1

	 * SSC downspread and ref clock variation margin:

drivers/gpu/drm/nouveau/nouveau_dmem.c

+6 −6
Original line number Diff line number Diff line
@@ -378,9 +378,9 @@ nouveau_dmem_evict_chunk(struct nouveau_dmem_chunk *chunk) 
	dma_addr_t *dma_addrs;

	struct nouveau_fence *fence;



	src_pfns = kcalloc(npages, sizeof(*src_pfns), GFP_KERNEL);

	dst_pfns = kcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL);

	dma_addrs = kcalloc(npages, sizeof(*dma_addrs), GFP_KERNEL);

	src_pfns = kvcalloc(npages, sizeof(*src_pfns), GFP_KERNEL | __GFP_NOFAIL);

	dst_pfns = kvcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL | __GFP_NOFAIL);

	dma_addrs = kvcalloc(npages, sizeof(*dma_addrs), GFP_KERNEL | __GFP_NOFAIL);



	migrate_device_range(src_pfns, chunk->pagemap.range.start >> PAGE_SHIFT,

			npages);
@@ -406,11 +406,11 @@ nouveau_dmem_evict_chunk(struct nouveau_dmem_chunk *chunk) 
	migrate_device_pages(src_pfns, dst_pfns, npages);

	nouveau_dmem_fence_done(&fence);

	migrate_device_finalize(src_pfns, dst_pfns, npages);

	kfree(src_pfns);

	kfree(dst_pfns);

	kvfree(src_pfns);

	kvfree(dst_pfns);

	for (i = 0; i < npages; i++)

		dma_unmap_page(chunk->drm->dev->dev, dma_addrs[i], PAGE_SIZE, DMA_BIDIRECTIONAL);

	kfree(dma_addrs);

	kvfree(dma_addrs);

}



void

drivers/gpu/drm/qxl/qxl_cmd.c

+0 −2
Original line number Diff line number Diff line
@@ -421,7 +421,6 @@ int qxl_surface_id_alloc(struct qxl_device *qdev, 
{

	uint32_t handle;

	int idr_ret;

	int count = 0;

again:

	idr_preload(GFP_ATOMIC);

	spin_lock(&qdev->surf_id_idr_lock);
@@ -433,7 +432,6 @@ int qxl_surface_id_alloc(struct qxl_device *qdev, 
	handle = idr_ret;



	if (handle >= qdev->rom->n_surfaces) {

		count++;

		spin_lock(&qdev->surf_id_idr_lock);

		idr_remove(&qdev->surf_id_idr, handle);

		spin_unlock(&qdev->surf_id_idr_lock);

drivers/gpu/drm/qxl/qxl_ioctl.c

+1 −3
Original line number Diff line number Diff line
@@ -145,7 +145,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, 
	struct qxl_release *release;

	struct qxl_bo *cmd_bo;

	void *fb_cmd;

	int i, ret, num_relocs;

	int i, ret;

	int unwritten;



	switch (cmd->type) {
@@ -200,7 +200,6 @@ static int qxl_process_single_command(struct qxl_device *qdev, 
	}



	/* fill out reloc info structs */

	num_relocs = 0;

	for (i = 0; i < cmd->relocs_num; ++i) {

		struct drm_qxl_reloc reloc;

		struct drm_qxl_reloc __user *u = u64_to_user_ptr(cmd->relocs);
@@ -230,7 +229,6 @@ static int qxl_process_single_command(struct qxl_device *qdev, 
			reloc_info[i].dst_bo = cmd_bo;

			reloc_info[i].dst_offset = reloc.dst_offset + release->release_offset;

		}

		num_relocs++;



		/* reserve and validate the reloc dst bo */

		if (reloc.reloc_type == QXL_RELOC_TYPE_BO || reloc.src_handle) {