github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-31 03:27:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm-misc-fixes for v6.19-rc8:

Browse Source 
- Fix a WARN_ON() when passing an invalid handle to
   drm_gem_change_handle_ioctl()
 - drop ddc device reference when unloading in imx/tve.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAml7kdcACgkQ/lWMcqZw
 E8M8Tw//dJOw7QKRke5aZrMV6nHGP5T/uT2XNBCCEP4edNMvGgt0+OkZM4WhnWq9
 jrO1K6LvE/H5QQtjM/v4J9u0OI18oSqtCFtc1/yVg6R6fmFIJ/iOEYGFtIOpzGz8
 UHku4YGclmhORoUnhomzqgQbP/23N3NAr61V3s6GIfQqZyMGSAxcUvzR0dzjvQJS
 iMlVbJQuS739G9bIs7kslczBpDo6CBig+9B2s4RhQ7ZkVHjAGQYkOsPloNMUG4Zi
 VrLjwfA7CaNIT3HAsCoxrLejSX8LIeEcTqFdTajVabUkWYCrU1Np6RIkPRqP8I/g
 KpQBNL58BbMrAl91ciCwmcEzTKkUqz+yjnThHsydJMtaofGAbZe549eUapkFEPUF
 Sbu1i2nOfiuv4nTqUv9XFea6X5ni9weBirkcXaXbqxgeOuCQvDLuntLp/FMCh4YO
 YQnlYXYDO18GFuxCIYDLAoz44VAwd9KiqPw3jGs/KEPrKRkJAGWHwPdDW+A8DcZx
 V7WcQqcggoanScCmVKAfHlVdHr+GGz220PpPvu+q5NS8FvvOVRGtHD6alf6diUFw
 yhVSQuc4T0ned+MH99l7/uBr3fr9i+ItWuNCsAP0/4mB9UWoRucMPyPyc2TAx62C
 pGSrsxR6fsh2wtnZvWZy0DtkK5krzsZTaM3NP93DR01IePqXFcE=
 =F2Cn
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

drm-misc-fixes for v6.19-rc8:
- Fix a WARN_ON() when passing an invalid handle to
  drm_gem_change_handle_ioctl()
- drop ddc device reference when unloading in imx/tve.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/a34d967e-b111-4b29-8c97-af3e77b5d33e@linux.intel.com
This commit is contained in:
Dave Airlie 2026-01-30 11:47:01 +10:00
commit 3a390a21ff
2 changed files with 25 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/gpu/drm/drm_gem.c
View File

@ -960,16 +960,21 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
{
struct drm_gem_change_handle *args = data;
struct drm_gem_object *obj;
int ret;
int handle, ret;
if (!drm_core_check_feature(dev, DRIVER_GEM))
return -EOPNOTSUPP;
/* idr_alloc() limitation. */
if (args->new_handle > INT_MAX)
return -EINVAL;
handle = args->new_handle;
obj = drm_gem_object_lookup(file_priv, args->handle);
if (!obj)
return -ENOENT;
if (args->handle == args->new_handle) {
if (args->handle == handle) {
ret = 0;
goto out;
}
@ -977,18 +982,19 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
mutex_lock(&file_priv->prime.lock);
spin_lock(&file_priv->table_lock);
ret = idr_alloc(&file_priv->object_idr, obj,
args->new_handle, args->new_handle + 1, GFP_NOWAIT);
ret = idr_alloc(&file_priv->object_idr, obj, handle, handle + 1,
GFP_NOWAIT);
spin_unlock(&file_priv->table_lock);
if (ret < 0)
goto out_unlock;
if (obj->dma_buf) {
ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf, args->new_handle);
ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,
handle);
if (ret < 0) {
spin_lock(&file_priv->table_lock);
idr_remove(&file_priv->object_idr, args->new_handle);
idr_remove(&file_priv->object_idr, handle);
spin_unlock(&file_priv->table_lock);
goto out_unlock;
}

13
drivers/gpu/drm/imx/ipuv3/imx-tve.c
View File

@ -528,6 +528,13 @@ static const struct component_ops imx_tve_ops = {
.bind = imx_tve_bind,
};
static void imx_tve_put_device(void *_dev)
{
struct device *dev = _dev;
put_device(dev);
}
static int imx_tve_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@ -549,6 +556,12 @@ static int imx_tve_probe(struct platform_device *pdev)
if (ddc_node) {
tve->ddc = of_find_i2c_adapter_by_node(ddc_node);
of_node_put(ddc_node);
if (tve->ddc) {
ret = devm_add_action_or_reset(dev, imx_tve_put_device,
&tve->ddc->dev);
if (ret)
return ret;
}
}
tve->mode = of_get_tve_mode(np);