dri-devel March 2021

dri-devel@lists.freedesktop.org

326 participants
867 discussions

[PATCH] drivers: gpu: drm: xen_drm_front_drm_info is declared twice
by Wan Jiabing 25 Mar '21

25 Mar '21

struct xen_drm_front_drm_info has been declared. Remove the duplicate. Signed-off-by: Wan Jiabing <wanjiabing(a)vivo.com> --- drivers/gpu/drm/xen/xen_drm_front_conn.h | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpu/drm/xen/xen_drm_front_conn.h b/drivers/gpu/drm/xen/xen_drm_front_conn.h index 3adacba9a23b..e5f4314899ee 100644 --- a/drivers/gpu/drm/xen/xen_drm_front_conn.h +++ b/drivers/gpu/drm/xen/xen_drm_front_conn.h @@ -16,7 +16,6 @@ struct drm_connector; struct xen_drm_front_drm_info; -struct xen_drm_front_drm_info; int xen_drm_front_conn_init(struct xen_drm_front_drm_info *drm_info, struct drm_connector *connector); -- 2.25.1

3 4

linux-next: please do not base your tree on v5.12-rc1-dontuse
by Stephen Rothwell 25 Mar '21

25 Mar '21

Hi all, The latest version of the drm-misc tree consists of just 2 commits on top of Linus' v5.12-rc1-dontuse tag. -- Cheers, Stephen Rothwell

2 1

[PATCH] drm/virtio: check the return value of virtio_gpu_alloc_cmd_resp()
by Liu Xiang 25 Mar '21

25 Mar '21

Now there is no check with the return value of virtio_gpu_alloc_cmd_resp(). If it fails, the following operation will cause a fault. Signed-off-by: Liu Xiang <liu.xiang(a)zlingsmart.com> --- drivers/gpu/drm/virtio/virtgpu_vq.c | 89 +++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index cf84d382d..2e59ad55f 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -507,6 +507,9 @@ void virtio_gpu_cmd_create_resource(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->objs = objs; @@ -540,6 +543,9 @@ void virtio_gpu_cmd_unref_resource(struct virtio_gpu_device *vgdev, cmd_p = virtio_gpu_alloc_cmd_cb(vgdev, &vbuf, sizeof(*cmd_p), virtio_gpu_cmd_unref_cb); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_RESOURCE_UNREF); @@ -560,6 +566,9 @@ void virtio_gpu_cmd_set_scanout(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_SET_SCANOUT); @@ -582,6 +591,9 @@ void virtio_gpu_cmd_resource_flush(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_RESOURCE_FLUSH); @@ -612,6 +624,9 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev, shmem->pages, DMA_TO_DEVICE); cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->objs = objs; @@ -637,6 +652,9 @@ virtio_gpu_cmd_resource_attach_backing(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING); @@ -778,6 +796,11 @@ int virtio_gpu_cmd_get_display_info(struct virtio_gpu_device *vgdev) (vgdev, &virtio_gpu_cmd_get_display_info_cb, &vbuf, sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_display_info), resp_buf); + if (IS_ERR(cmd_p)) { + kfree(resp_buf); + return PTR_ERR(cmd_p); + } + memset(cmd_p, 0, sizeof(*cmd_p)); vgdev->display_info_pending = true; @@ -801,6 +824,11 @@ int virtio_gpu_cmd_get_capset_info(struct virtio_gpu_device *vgdev, int idx) (vgdev, &virtio_gpu_cmd_get_capset_info_cb, &vbuf, sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_capset_info), resp_buf); + if (IS_ERR(cmd_p)) { + kfree(resp_buf); + return PTR_ERR(cmd_p); + } + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_GET_CAPSET_INFO); @@ -876,6 +904,13 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev, (vgdev, &virtio_gpu_cmd_capset_cb, &vbuf, sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_capset) + max_size, resp_buf); + if (IS_ERR(cmd_p)) { + kfree(resp_buf); + kfree(cache_ent->caps_cache); + kfree(cache_ent); + return PTR_ERR(cmd_p); + } + cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_GET_CAPSET); cmd_p->capset_id = cpu_to_le32(vgdev->capsets[idx].id); cmd_p->capset_version = cpu_to_le32(version); @@ -905,6 +940,11 @@ int virtio_gpu_cmd_get_edids(struct virtio_gpu_device *vgdev) (vgdev, &virtio_gpu_cmd_get_edid_cb, &vbuf, sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_edid), resp_buf); + if (IS_ERR(cmd_p)) { + kfree(resp_buf); + return PTR_ERR(cmd_p); + } + cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_GET_EDID); cmd_p->scanout = cpu_to_le32(scanout); virtio_gpu_queue_ctrl_buffer(vgdev, vbuf); @@ -920,6 +960,9 @@ void virtio_gpu_cmd_context_create(struct virtio_gpu_device *vgdev, uint32_t id, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_CTX_CREATE); @@ -937,6 +980,9 @@ void virtio_gpu_cmd_context_destroy(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_CTX_DESTROY); @@ -953,6 +999,9 @@ void virtio_gpu_cmd_context_attach_resource(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->objs = objs; @@ -971,6 +1020,9 @@ void virtio_gpu_cmd_context_detach_resource(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->objs = objs; @@ -991,6 +1043,9 @@ virtio_gpu_cmd_resource_create_3d(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->objs = objs; @@ -1034,6 +1089,9 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev, } cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->objs = objs; @@ -1064,6 +1122,9 @@ void virtio_gpu_cmd_transfer_from_host_3d(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->objs = objs; @@ -1090,6 +1151,9 @@ void virtio_gpu_cmd_submit(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); vbuf->data_buf = data; @@ -1120,6 +1184,8 @@ void virtio_gpu_cursor_ping(struct virtio_gpu_device *vgdev, output->cursor.pos.scanout_id = cpu_to_le32(output->index); cur_p = virtio_gpu_alloc_cursor(vgdev, &vbuf); + if (IS_ERR(cur_p)) + return; memcpy(cur_p, &output->cursor, sizeof(output->cursor)); virtio_gpu_queue_cursor(vgdev, vbuf); } @@ -1169,6 +1235,15 @@ virtio_gpu_cmd_resource_assign_uuid(struct virtio_gpu_device *vgdev, cmd_p = virtio_gpu_alloc_cmd_resp (vgdev, virtio_gpu_cmd_resource_uuid_cb, &vbuf, sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_resource_uuid), resp_buf); + if (IS_ERR(cmd_p)) { + spin_lock(&vgdev->resource_export_lock); + bo->uuid_state = STATE_ERR; + spin_unlock(&vgdev->resource_export_lock); + virtio_gpu_array_put_free(objs); + kfree(resp_buf); + return PTR_ERR(cmd_p); + } + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_RESOURCE_ASSIGN_UUID); @@ -1217,6 +1292,11 @@ int virtio_gpu_cmd_map(struct virtio_gpu_device *vgdev, cmd_p = virtio_gpu_alloc_cmd_resp (vgdev, virtio_gpu_cmd_resource_map_cb, &vbuf, sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_map_info), resp_buf); + if (IS_ERR(cmd_p)) { + kfree(resp_buf); + return PTR_ERR(cmd_p); + } + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_RESOURCE_MAP_BLOB); @@ -1235,6 +1315,9 @@ void virtio_gpu_cmd_unmap(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_RESOURCE_UNMAP_BLOB); @@ -1254,6 +1337,9 @@ virtio_gpu_cmd_resource_create_blob(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_RESOURCE_CREATE_BLOB); @@ -1285,6 +1371,9 @@ void virtio_gpu_cmd_set_scanout_blob(struct virtio_gpu_device *vgdev, uint32_t format = virtio_gpu_translate_format(fb->format->format); cmd_p = virtio_gpu_alloc_cmd(vgdev, &vbuf, sizeof(*cmd_p)); + if (IS_ERR(cmd_p)) + return; + memset(cmd_p, 0, sizeof(*cmd_p)); cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_SET_SCANOUT_BLOB); -- 2.17.1

1 0

[PATCH v3 00/15] Introduce devm_pm_opp_* API
by Dmitry Osipenko 25 Mar '21

25 Mar '21

This series adds resource-managed OPP API helpers and makes drivers to use them. Changelog: v3: - Dropped dev_pm_opp_register_notifier(). - Changed return type of the devm helpers from opp_table pointer to errno. - Corrected drm/msm patch which missed to remove opp_put_supported_hw() from a6xx_gpu. Note that the a5xx_gpu driver was missing the opp_put_supported_hw() at all. - Corrected spelling of the ack from Mark Brown. v2: - This is a continuation of the work that was started by Yangtao Li. Apparently Yangtao doesn't have time to finish it, so I (Dmitry Osipenko) picked up the effort since these patches are wanted by the NVIDIA Tegra voltage-scaling series that I'm working on. - Fixed the double put of OPP resources. - Dropped all patches that are unrelated to OPP API. I also dropped the Tegra memory patch since it doesn't apply now and because I plan to switch all Tegra drivers soon to a common tegra-specific OPP helper that will use the resource-managed OPP API anyways. - Squashed couple patches into a single ones since there was no good reason to separate them. - Added acks that were given to a couple of v1 patches. Dmitry Osipenko (2): opp: Change return type of devm_pm_opp_register_set_opp_helper() opp: Change return type of devm_pm_opp_attach_genpd() Yangtao Li (13): opp: Add devres wrapper for dev_pm_opp_set_clkname opp: Add devres wrapper for dev_pm_opp_set_regulators opp: Add devres wrapper for dev_pm_opp_set_supported_hw opp: Add devres wrapper for dev_pm_opp_of_add_table serial: qcom_geni_serial: Convert to use resource-managed OPP API spi: spi-geni-qcom: Convert to use resource-managed OPP API spi: spi-qcom-qspi: Convert to use resource-managed OPP API mmc: sdhci-msm: Convert to use resource-managed OPP API drm/msm: Convert to use resource-managed OPP API drm/lima: Convert to use resource-managed OPP API drm/panfrost: Convert to use resource-managed OPP API media: venus: Convert to use resource-managed OPP API memory: samsung: exynos5422-dmc: Convert to use resource-managed OPP API drivers/gpu/drm/lima/lima_devfreq.c | 47 ++----- drivers/gpu/drm/lima/lima_devfreq.h | 3 - drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 11 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 2 - drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 23 ++-- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 2 - drivers/gpu/drm/msm/dp/dp_ctrl.c | 30 +---- drivers/gpu/drm/msm/dp/dp_ctrl.h | 1 - drivers/gpu/drm/msm/dp/dp_display.c | 5 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 13 +- drivers/gpu/drm/panfrost/panfrost_devfreq.c | 37 ++---- drivers/gpu/drm/panfrost/panfrost_devfreq.h | 2 - drivers/media/platform/qcom/venus/core.h | 1 - .../media/platform/qcom/venus/pm_helpers.c | 35 ++--- drivers/memory/samsung/exynos5422-dmc.c | 13 +- drivers/mmc/host/sdhci-msm.c | 19 +-- drivers/opp/core.c | 122 ++++++++++++++---- drivers/opp/of.c | 36 ++++++ drivers/spi/spi-geni-qcom.c | 16 +-- drivers/spi/spi-qcom-qspi.c | 18 +-- drivers/tty/serial/qcom_geni_serial.c | 23 ++-- include/linux/pm_opp.h | 43 +++++- include/linux/qcom-geni-se.h | 2 - 26 files changed, 250 insertions(+), 260 deletions(-) -- 2.30.2

3 19

[PATCH] drivers: gpu: drm: Remove duplicate declaration
by Wan Jiabing 25 Mar '21

25 Mar '21

struct dss_device has been declared at 51st line. Remove the duplicate. Signed-off-by: Wan Jiabing <wanjiabing(a)vivo.com> --- drivers/gpu/drm/omapdrm/dss/omapdss.h | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpu/drm/omapdrm/dss/omapdss.h b/drivers/gpu/drm/omapdrm/dss/omapdss.h index a40abeafd2e9..2658aadee09a 100644 --- a/drivers/gpu/drm/omapdrm/dss/omapdss.h +++ b/drivers/gpu/drm/omapdrm/dss/omapdss.h @@ -52,7 +52,6 @@ struct dss_device; struct omap_drm_private; struct omap_dss_device; struct dispc_device; -struct dss_device; struct dss_lcd_mgr_config; struct snd_aes_iec958; struct snd_cea_861_aud_if; -- 2.25.1

2 1

Re: WARNING: AMDGPU DRM warning in 5.11.9
by Oleksandr Natalenko 25 Mar '21

25 Mar '21

Hello. On Thu, Mar 25, 2021 at 07:57:33AM +0200, Ilkka Prusi wrote: > On 24.3.2021 16.16, Chris Rankin wrote: > > Hi, > > > > Theee warnings ares not present in my dmesg log from 5.11.8: > > > > [ 43.390159] ------------[ cut here ]------------ > > [ 43.393574] WARNING: CPU: 2 PID: 1268 at > > drivers/gpu/drm/ttm/ttm_bo.c:517 ttm_bo_release+0x172/0x282 [ttm] > > [ 43.401940] Modules linked in: nf_nat_ftp nf_conntrack_ftp cfg80211 > > Changing WARN_ON to WARN_ON_ONCE in drivers/gpu/drm/ttm/ttm_bo.c > ttm_bo_release() reduces the flood of messages into single splat. > > This warning appears to come from 57fcd550eb15bce ("drm/ttm: Warn on pinning > without holding a reference)" and reverting it might be one choice. > > > > > > There are others, but I am assuming there is a common cause here. > > > > Cheers, > > Chris > > > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c > index a76eb2c14e8c..50b53355b265 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo.c > +++ b/drivers/gpu/drm/ttm/ttm_bo.c > @@ -514,7 +514,7 @@ static void ttm_bo_release(struct kref *kref) > * shrinkers, now that they are queued for > * destruction. > */ > - if (WARN_ON(bo->pin_count)) { > + if (WARN_ON_ONCE(bo->pin_count)) { > bo->pin_count = 0; > ttm_bo_del_from_lru(bo); > ttm_bo_add_mem_to_lru(bo, &bo->mem); > > > > -- > - Ilkka > WARN_ON_ONCE() will just hide the underlying problem. Do we know why this happens at all? Same for me, BTW, with v5.11.9: ``` [~]> lspci | grep VGA 0a:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Lexa PRO [Radeon 540/540X/550/550X / RX 540X/550/550X] (rev c7) [ 3676.033140] ------------[ cut here ]------------ [ 3676.033153] WARNING: CPU: 7 PID: 1318 at drivers/gpu/drm/ttm/ttm_bo.c:517 ttm_bo_release+0x375/0x500 [ttm] … [ 3676.033340] Hardware name: ASUS System Product Name/Pro WS X570-ACE, BIOS 3302 03/05/2021 … [ 3676.033469] Call Trace: [ 3676.033473] ttm_bo_move_accel_cleanup+0x1ab/0x3a0 [ttm] [ 3676.033478] amdgpu_bo_move+0x334/0x860 [amdgpu] [ 3676.033580] ttm_bo_validate+0x1f1/0x2d0 [ttm] [ 3676.033585] amdgpu_cs_bo_validate+0x9b/0x1c0 [amdgpu] [ 3676.033665] amdgpu_cs_list_validate+0x115/0x150 [amdgpu] [ 3676.033743] amdgpu_cs_ioctl+0x873/0x20a0 [amdgpu] [ 3676.033960] drm_ioctl_kernel+0xb8/0x140 [drm] [ 3676.033977] drm_ioctl+0x222/0x3c0 [drm] [ 3676.034071] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] [ 3676.034145] __x64_sys_ioctl+0x83/0xb0 [ 3676.034149] do_syscall_64+0x33/0x40 … [ 3676.034171] ---[ end trace 66e9865b027112f3 ]--- ``` Thanks. -- Oleksandr Natalenko (post-factum)

2 1

[PATCH] [v3] drm/imx: imx-ldb: fix out of bounds array access warning
by Arnd Bergmann 25 Mar '21

25 Mar '21

From: Arnd Bergmann <arnd(a)arndb.de> When CONFIG_OF is disabled, building with 'make W=1' produces warnings about out of bounds array access: drivers/gpu/drm/imx/imx-ldb.c: In function 'imx_ldb_set_clock.constprop': drivers/gpu/drm/imx/imx-ldb.c:186:8: error: array subscript -22 is below array bounds of 'struct clk *[4]' [-Werror=array-bounds] Add an error check before the index is used, which helps with the warning, as well as any possible other error condition that may be triggered at runtime. The warning could be fixed by adding a Kconfig depedency on CONFIG_OF, but Liu Ying points out that the driver may hit the out-of-bounds problem at runtime anyway. Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- v3: fix build regression from v2 v2: fix subject line expand patch description print mux number check upper bound as well --- drivers/gpu/drm/imx/imx-ldb.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c index dbfe39e2f7f6..565482e2b816 100644 --- a/drivers/gpu/drm/imx/imx-ldb.c +++ b/drivers/gpu/drm/imx/imx-ldb.c @@ -197,6 +197,11 @@ static void imx_ldb_encoder_enable(struct drm_encoder *encoder) int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN; int mux = drm_of_encoder_active_port_id(imx_ldb_ch->child, encoder); + if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) { + dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux); + return; + } + drm_panel_prepare(imx_ldb_ch->panel); if (dual) { @@ -255,6 +260,11 @@ imx_ldb_encoder_atomic_mode_set(struct drm_encoder *encoder, int mux = drm_of_encoder_active_port_id(imx_ldb_ch->child, encoder); u32 bus_format = imx_ldb_ch->bus_format; + if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) { + dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux); + return; + } + if (mode->clock > 170000) { dev_warn(ldb->dev, "%s: mode exceeds 170 MHz pixel clock\n", __func__); -- 2.29.2

3 2

[PATCH] drm/imx: imx-ldb: Register LDB channel1 when it is the only channel to be used
by Liu Ying 25 Mar '21

25 Mar '21

LDB channel1 should be registered if it is the only channel to be used. Without this patch, imx_ldb_bind() would skip registering LDB channel1 if LDB channel0 is not used, no matter LDB channel1 needs to be used or not. Fixes: 8767f4711b2b (drm/imx: imx-ldb: move initialization into probe) Signed-off-by: Liu Ying <victor.liu(a)nxp.com> --- This patch fixes an issue introduced in v5.12-rc1. It would be good to fix sooner than later. drivers/gpu/drm/imx/imx-ldb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c index dbfe39e..b794ed4 100644 --- a/drivers/gpu/drm/imx/imx-ldb.c +++ b/drivers/gpu/drm/imx/imx-ldb.c @@ -583,7 +583,7 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) struct imx_ldb_channel *channel = &imx_ldb->channel[i]; if (!channel->ldb) - break; + continue; ret = imx_ldb_register(drm, channel); if (ret) -- 2.7.4

2 1

[PATCH] drm/imx: fix memory leak when fails to init
by Pan Bian 25 Mar '21

25 Mar '21

Put DRM device on initialization failure path rather than directly return error code. Fixes: a67d5088ceb8 ("drm/imx: drop explicit drm_mode_config_cleanup") Signed-off-by: Pan Bian <bianpan2016(a)163.com> --- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c index d1a9841adeed..e6a88c8cbd69 100644 --- a/drivers/gpu/drm/imx/imx-drm-core.c +++ b/drivers/gpu/drm/imx/imx-drm-core.c @@ -215,7 +215,7 @@ static int imx_drm_bind(struct device *dev) ret = drmm_mode_config_init(drm); if (ret) - return ret; + goto err_kms; ret = drm_vblank_init(drm, MAX_CRTC); if (ret) -- 2.17.1

2 1

[PATCH] gpu/xen: Fix a use after free in xen_drm_drv_init
by Lv Yunlong 25 Mar '21

25 Mar '21

In function displback_changed, has the call chain displback_connect(front_info)->xen_drm_drv_init(front_info). We can see that drm_info is assigned to front_info->drm_info and drm_info is freed in fail branch in xen_drm_drv_init(). Later displback_disconnect(front_info) is called and it calls xen_drm_drv_fini(front_info) cause a use after free by drm_info = front_info->drm_info statement. My patch has done two things. First fixes the fail label which drm_info = kzalloc() failed and still free the drm_info. Second sets front_info->drm_info to NULL to avoid uaf. Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> --- drivers/gpu/drm/xen/xen_drm_front.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/xen/xen_drm_front.c b/drivers/gpu/drm/xen/xen_drm_front.c index 30d9adf31c84..9f14d99c763c 100644 --- a/drivers/gpu/drm/xen/xen_drm_front.c +++ b/drivers/gpu/drm/xen/xen_drm_front.c @@ -521,7 +521,7 @@ static int xen_drm_drv_init(struct xen_drm_front_info *front_info) drm_dev = drm_dev_alloc(&xen_drm_driver, dev); if (IS_ERR(drm_dev)) { ret = PTR_ERR(drm_dev); - goto fail; + goto fail_dev; } drm_info->drm_dev = drm_dev; @@ -551,8 +551,10 @@ static int xen_drm_drv_init(struct xen_drm_front_info *front_info) drm_kms_helper_poll_fini(drm_dev); drm_mode_config_cleanup(drm_dev); drm_dev_put(drm_dev); -fail: +fail_dev: kfree(drm_info); + front_info->drm_info = NULL; +fail: return ret; } -- 2.25.1

2 1

← Newer
1
...
33
34
35
36
37
38
39
...
87
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel March 2021