Merge tag 'drm-misc-fixes-2022-05-26' of git://anongit.freedesktop.org/drm/drm-misc...

A use-after-free fix for panfrost, and a DT invalid configuration fix for
ti-sn65dsi83

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20220526090532.nvhlmwev5qgln3nb@houat

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
index 2831f0813c3a8cd0bf9776045c029d418cfa0e1a..ac66f408b40c5afa90b8787106dbe4deb432e647 100644 (file)
--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
@@ -577,7 +577,7 @@ static int sn65dsi83_parse_dt(struct sn65dsi83 *ctx, enum sn65dsi83_model model)
        ctx->host_node = of_graph_get_remote_port_parent(endpoint);
        of_node_put(endpoint);
 
-       if (ctx->dsi_lanes < 0 || ctx->dsi_lanes > 4) {
+       if (ctx->dsi_lanes <= 0 || ctx->dsi_lanes > 4) {
                ret = -EINVAL;
                goto err_put_node;
        }

diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index 7fcbc2a5b6cda8f31813b90685dbe4546319a59d..087e69b98d0694b8ce1037c8df8b7277e309b9e1 100644 (file)
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -233,6 +233,7 @@ static int panfrost_ioctl_submit(struct drm_device *dev, void *data,
                struct drm_file *file)
 {
        struct panfrost_device *pfdev = dev->dev_private;
+       struct panfrost_file_priv *file_priv = file->driver_priv;
        struct drm_panfrost_submit *args = data;
        struct drm_syncobj *sync_out = NULL;
        struct panfrost_job *job;
@@ -262,12 +263,12 @@ static int panfrost_ioctl_submit(struct drm_device *dev, void *data,
        job->jc = args->jc;
        job->requirements = args->requirements;
        job->flush_id = panfrost_gpu_get_latest_flush_id(pfdev);
-       job->file_priv = file->driver_priv;
+       job->mmu = file_priv->mmu;
 
        slot = panfrost_job_get_slot(job);
 
        ret = drm_sched_job_init(&job->base,
-                                &job->file_priv->sched_entity[slot],
+                                &file_priv->sched_entity[slot],
                                 NULL);
        if (ret)
                goto out_put_job;

diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
index fda5871aebe3079dd2c5ef1628762e285b2f3519..7c4208476fbd34457e3c248eed53f1a9e9a02bbb 100644 (file)
--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -201,7 +201,7 @@ static void panfrost_job_hw_submit(struct panfrost_job *job, int js)
                return;
        }
 
-       cfg = panfrost_mmu_as_get(pfdev, job->file_priv->mmu);
+       cfg = panfrost_mmu_as_get(pfdev, job->mmu);
 
        job_write(pfdev, JS_HEAD_NEXT_LO(js), lower_32_bits(jc_head));
        job_write(pfdev, JS_HEAD_NEXT_HI(js), upper_32_bits(jc_head));
@@ -435,7 +435,7 @@ static void panfrost_job_handle_err(struct panfrost_device *pfdev,
                job->jc = 0;
        }
 
-       panfrost_mmu_as_put(pfdev, job->file_priv->mmu);
+       panfrost_mmu_as_put(pfdev, job->mmu);
        panfrost_devfreq_record_idle(&pfdev->pfdevfreq);
 
        if (signal_fence)
@@ -456,7 +456,7 @@ static void panfrost_job_handle_done(struct panfrost_device *pfdev,
         * happen when we receive the DONE interrupt while doing a GPU reset).
         */
        job->jc = 0;
-       panfrost_mmu_as_put(pfdev, job->file_priv->mmu);
+       panfrost_mmu_as_put(pfdev, job->mmu);
        panfrost_devfreq_record_idle(&pfdev->pfdevfreq);
 
        dma_fence_signal_locked(job->done_fence);

diff --git a/drivers/gpu/drm/panfrost/panfrost_job.h b/drivers/gpu/drm/panfrost/panfrost_job.h
index 77e6d0e6f612fa7c63e9d1662102e1b2e57fceb4..8becc1ba0eb95210850fc9b1b49f20d39bcc8ba1 100644 (file)
--- a/drivers/gpu/drm/panfrost/panfrost_job.h
+++ b/drivers/gpu/drm/panfrost/panfrost_job.h
@@ -17,7 +17,7 @@ struct panfrost_job {
        struct kref refcount;
 
        struct panfrost_device *pfdev;
-       struct panfrost_file_priv *file_priv;
+       struct panfrost_mmu *mmu;
 
        /* Fence to be signaled by IRQ handler when the job is complete. */
        struct dma_fence *done_fence;