Skip to content

Commit 2e41a66

Browse files
airliedairlied
committed
Merge tag 'drm-misc-fixes-2021-07-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
Short summary of fixes pull: * Return -ENOTTY for non-DRM ioctls * amdgpu: Fix COW checks * nouveau: init BO GME fields * panel: Avoid double free * ttm: Fix refcounting in ttm_global_init(); NULL checks * vc4: Fix interrupt handling Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/YPlbkmH6S4VAHP9j@linux-uq9g.fritz.box
2 parents 36ebaeb + 7bbcb91 commit 2e41a66

File tree

9 files changed

+60
-17
lines changed

9 files changed

+60
-17
lines changed

‎drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,15 @@ static int amdgpu_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_str
255255
if (bo->flags & AMDGPU_GEM_CREATE_NO_CPU_ACCESS)
256256
return -EPERM;
257257

258+
/* Workaround for Thunk bug creating PROT_NONE,MAP_PRIVATE mappings
259+
* for debugger access to invisible VRAM. Should have used MAP_SHARED
260+
* instead. Clearing VM_MAYWRITE prevents the mapping from ever
261+
* becoming writable and makes is_cow_mapping(vm_flags) false.
262+
*/
263+
if (is_cow_mapping(vma->vm_flags) &&
264+
!(vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)))
265+
vma->vm_flags &= ~VM_MAYWRITE;
266+
258267
return drm_gem_ttm_mmap(obj, vma);
259268
}
260269

‎drivers/gpu/drm/drm_ioctl.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -834,6 +834,9 @@ long drm_ioctl(struct file *filp,
834834
if (drm_dev_is_unplugged(dev))
835835
return -ENODEV;
836836

837+
if (DRM_IOCTL_TYPE(cmd) != DRM_IOCTL_BASE)
838+
return -ENOTTY;
839+
837840
is_driver_ioctl = nr >= DRM_COMMAND_BASE && nr < DRM_COMMAND_END;
838841

839842
if (is_driver_ioctl) {

‎drivers/gpu/drm/nouveau/nouveau_bo.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,8 @@ nouveau_bo_del_ttm(struct ttm_buffer_object *bo)
149149
*/
150150
if (bo->base.dev)
151151
drm_gem_object_release(&bo->base);
152+
else
153+
dma_resv_fini(&bo->base._resv);
152154

153155
kfree(nvbo);
154156
}
@@ -330,6 +332,10 @@ nouveau_bo_new(struct nouveau_cli *cli, u64 size, int align,
330332
if (IS_ERR(nvbo))
331333
return PTR_ERR(nvbo);
332334

335+
nvbo->bo.base.size = size;
336+
dma_resv_init(&nvbo->bo.base._resv);
337+
drm_vma_node_reset(&nvbo->bo.base.vma_node);
338+
333339
ret = nouveau_bo_init(nvbo, size, align, domain, sg, robj);
334340
if (ret)
335341
return ret;

‎drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -447,7 +447,6 @@ static int rpi_touchscreen_remove(struct i2c_client *i2c)
447447
drm_panel_remove(&ts->base);
448448

449449
mipi_dsi_device_unregister(ts->dsi);
450-
kfree(ts->dsi);
451450

452451
return 0;
453452
}

‎drivers/gpu/drm/ttm/ttm_bo.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo,
102102
return;
103103
}
104104

105+
if (!mem)
106+
return;
107+
105108
man = ttm_manager_type(bdev, mem->mem_type);
106109
list_move_tail(&bo->lru, &man->lru[bo->priority]);
107110

‎drivers/gpu/drm/ttm/ttm_bo_util.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ int ttm_mem_io_reserve(struct ttm_device *bdev,
6363
void ttm_mem_io_free(struct ttm_device *bdev,
6464
struct ttm_resource *mem)
6565
{
66+
if (!mem)
67+
return;
68+
6669
if (!mem->bus.offset && !mem->bus.addr)
6770
return;
6871

‎drivers/gpu/drm/ttm/ttm_device.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,8 @@ static int ttm_global_init(void)
100100
debugfs_create_atomic_t("buffer_objects", 0444, ttm_debugfs_root,
101101
&glob->bo_count);
102102
out:
103+
if (ret)
104+
--ttm_glob_use_count;
103105
mutex_unlock(&ttm_global_mutex);
104106
return ret;
105107
}

‎drivers/gpu/drm/vc4/vc4_hdmi.c

Lines changed: 33 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1857,38 +1857,46 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
18571857
vc4_hdmi_cec_update_clk_div(vc4_hdmi);
18581858

18591859
if (vc4_hdmi->variant->external_irq_controller) {
1860-
ret = devm_request_threaded_irq(&pdev->dev,
1861-
platform_get_irq_byname(pdev, "cec-rx"),
1862-
vc4_cec_irq_handler_rx_bare,
1863-
vc4_cec_irq_handler_rx_thread, 0,
1864-
"vc4 hdmi cec rx", vc4_hdmi);
1860+
ret = request_threaded_irq(platform_get_irq_byname(pdev, "cec-rx"),
1861+
vc4_cec_irq_handler_rx_bare,
1862+
vc4_cec_irq_handler_rx_thread, 0,
1863+
"vc4 hdmi cec rx", vc4_hdmi);
18651864
if (ret)
18661865
goto err_delete_cec_adap;
18671866

1868-
ret = devm_request_threaded_irq(&pdev->dev,
1869-
platform_get_irq_byname(pdev, "cec-tx"),
1870-
vc4_cec_irq_handler_tx_bare,
1871-
vc4_cec_irq_handler_tx_thread, 0,
1872-
"vc4 hdmi cec tx", vc4_hdmi);
1867+
ret = request_threaded_irq(platform_get_irq_byname(pdev, "cec-tx"),
1868+
vc4_cec_irq_handler_tx_bare,
1869+
vc4_cec_irq_handler_tx_thread, 0,
1870+
"vc4 hdmi cec tx", vc4_hdmi);
18731871
if (ret)
1874-
goto err_delete_cec_adap;
1872+
goto err_remove_cec_rx_handler;
18751873
} else {
18761874
HDMI_WRITE(HDMI_CEC_CPU_MASK_SET, 0xffffffff);
18771875

1878-
ret = devm_request_threaded_irq(&pdev->dev, platform_get_irq(pdev, 0),
1879-
vc4_cec_irq_handler,
1880-
vc4_cec_irq_handler_thread, 0,
1881-
"vc4 hdmi cec", vc4_hdmi);
1876+
ret = request_threaded_irq(platform_get_irq(pdev, 0),
1877+
vc4_cec_irq_handler,
1878+
vc4_cec_irq_handler_thread, 0,
1879+
"vc4 hdmi cec", vc4_hdmi);
18821880
if (ret)
18831881
goto err_delete_cec_adap;
18841882
}
18851883

18861884
ret = cec_register_adapter(vc4_hdmi->cec_adap, &pdev->dev);
18871885
if (ret < 0)
1888-
goto err_delete_cec_adap;
1886+
goto err_remove_handlers;
18891887

18901888
return 0;
18911889

1890+
err_remove_handlers:
1891+
if (vc4_hdmi->variant->external_irq_controller)
1892+
free_irq(platform_get_irq_byname(pdev, "cec-tx"), vc4_hdmi);
1893+
else
1894+
free_irq(platform_get_irq(pdev, 0), vc4_hdmi);
1895+
1896+
err_remove_cec_rx_handler:
1897+
if (vc4_hdmi->variant->external_irq_controller)
1898+
free_irq(platform_get_irq_byname(pdev, "cec-rx"), vc4_hdmi);
1899+
18921900
err_delete_cec_adap:
18931901
cec_delete_adapter(vc4_hdmi->cec_adap);
18941902

@@ -1897,6 +1905,15 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
18971905

18981906
static void vc4_hdmi_cec_exit(struct vc4_hdmi *vc4_hdmi)
18991907
{
1908+
struct platform_device *pdev = vc4_hdmi->pdev;
1909+
1910+
if (vc4_hdmi->variant->external_irq_controller) {
1911+
free_irq(platform_get_irq_byname(pdev, "cec-rx"), vc4_hdmi);
1912+
free_irq(platform_get_irq_byname(pdev, "cec-tx"), vc4_hdmi);
1913+
} else {
1914+
free_irq(platform_get_irq(pdev, 0), vc4_hdmi);
1915+
}
1916+
19001917
cec_unregister_adapter(vc4_hdmi->cec_adap);
19011918
}
19021919
#else

‎include/drm/drm_ioctl.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ typedef int drm_ioctl_compat_t(struct file *filp, unsigned int cmd,
6868
unsigned long arg);
6969

7070
#define DRM_IOCTL_NR(n) _IOC_NR(n)
71+
#define DRM_IOCTL_TYPE(n) _IOC_TYPE(n)
7172
#define DRM_MAJOR 226
7273

7374
/**

0 commit comments

Comments
 (0)