github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

drm fixes for 7.1-rc1

Browse Source 
atomic:
 - raise the vblank timeout to avoid it on virtual drivers
 - fix colorop duplication
 
 bridge:
 - stm_lvds: state check fix
 - dw-mipi-dsi: bridge reference leak fix
 
 panel:
 - visionx-rm69299: init fix
 
 dma-fence:
 - fix sparse warning
 
 dma-buf:
 - UAF fix
 
 panthor:
 - mapping fix
 
 arcgpu:
 - device_node reference leak fix
 
 nouveau:
 - memory leak in error path fix
 - overflow in reloc path for old hw fix
 
 hv:
 - Kconfig fix
 
 v3d:
 - infinite loop fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmnrCR4ACgkQDHTzWXnE
 hr7HEw/9EynaVUxBlI+B+kKakkvt1fpRfaSwaWyawcqaS1XpBjwuUR/aUS44fHzE
 Z1ru6DACZPwKqRTTLm1urE7qjb3T1HKDgSV9LbLJCe3MOZ1HMmyfitoRgWvP/nXU
 bpwT7K79g0g87HMwVzyS13jqSeXmAbuuqF8cgyUsYUU7Jvl3tEd9FfOhwo4BG/4j
 4EDlj9SDrd6/3SbnKzVfrt6xl/ikpNxoYJlMVW3NIDzfZ8aKGdf/jYgKb3ezluDB
 2UAiZdFRiCQd0DunQvCBwnY5/dpxXIajWtAW2f6FWEqIS5mtXkVG6PPzpLRNEmkp
 wetjtnisqwkwSxFxz0pgEII0PsKoxKrQPBXz7zXH6bK6e3i4LQ09mt1Ufc3w9am3
 f29IW2AWYZzB1tOOmMt34mvDm49xXWt/7Q6hHAorQ9ABtb6V3SzsDKfDElEF2ULF
 g1WMCN9uh5ErWkEc1rqIjQ3TPI9EISfUG+hvvr75PA59EHE7a4tQGf45DNWPeC8+
 rO5m8aDKgif7exkoiA8fc8zq4shiH7/tGbJsnZP1GTgyQTBtT4Aik/rVT0zifDpY
 yQ0gwybnd9I7lXMVlhFPaq83HMsr38e8HyViubNmzA8zbd58cPRqBygPqIW6trWr
 6/kzoNFhjgICJsOSi8KkQAtT1zRnakiR1I3GfVos+1DyhC9yPIo=
 =WXJa
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel

Pull more drm fixes from Dave Airlie:
 "These are the regular fixes that have built up over last couple of
  weeks, all pretty minor and spread all over.

  atomic:
   - raise the vblank timeout to avoid it on virtual drivers
   - fix colorop duplication

  bridge:
   - stm_lvds: state check fix
   - dw-mipi-dsi: bridge reference leak fix

  panel:
   - visionx-rm69299: init fix

  dma-fence:
   - fix sparse warning

  dma-buf:
   - UAF fix

  panthor:
   - mapping fix

  arcgpu:
   - device_node reference leak fix

  nouveau:
   - memory leak in error path fix
   - overflow in reloc path for old hw fix

  hv:
   - Kconfig fix

  v3d:
   - infinite loop fix"

* tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel:
  drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
  MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm matainers
  drm/v3d: Reject empty multisync extension to prevent infinite loop
  drm/panel: visionox-rm69299: Make use of prepare_prev_first
  drm/drm_atomic: duplicate colorop states if plane color pipeline in use
  drm/nouveau: fix nvkm_device leak on aperture removal failure
  hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
  dma-fence: Silence sparse warning in dma_fence_describe
  drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach fails
  drm/arcpgu: fix device node leak
  drm/panthor: Fix outdated function documentation
  drm/panthor: Extend VM locked region for remap case to be a superset
  dma-buf: fix UAF in dma_buf_put() tracepoint
  drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector
  drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks()
This commit is contained in:
Linus Torvalds 2026-04-24 11:44:52 -07:00
commit cf950766e9
16 changed files with 73 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
MAINTAINERS
View File

@ -8602,10 +8602,17 @@ S: Maintained
T: git https://gitlab.freedesktop.org/drm/misc/kernel.git
F: drivers/gpu/drm/gma500/
DRM DRIVERS FOR HISILICON
M: Xinliang Liu <xinliang.liu@linaro.org>
DRM DRIVERS FOR HISILICON HIBMC
M: Yongbang Shi <shiyongbang@huawei.com>
M: Tian Tao <tiantao6@hisilicon.com>
R: Xinwei Kong <kong.kongxinwei@hisilicon.com>
L: dri-devel@lists.freedesktop.org
S: Maintained
T: git https://gitlab.freedesktop.org/drm/misc/kernel.git
F: drivers/gpu/drm/hisilicon/hibmc
DRM DRIVERS FOR HISILICON KIRIN
M: Xinliang Liu <xinliang.liu@linaro.org>
R: Sumit Semwal <sumit.semwal@linaro.org>
R: Yongqin Liu <yongqin.liu@linaro.org>
R: John Stultz <jstultz@google.com>
@ -8613,7 +8620,7 @@ L: dri-devel@lists.freedesktop.org
S: Maintained
T: git https://gitlab.freedesktop.org/drm/misc/kernel.git
F: Documentation/devicetree/bindings/display/hisilicon/
F: drivers/gpu/drm/hisilicon/
F: drivers/gpu/drm/hisilicon/kirin
DRM DRIVERS FOR LIMA
M: Qiang Yu <yuq825@gmail.com>

3
drivers/dma-buf/dma-buf.c
View File

@ -845,9 +845,8 @@ void dma_buf_put(struct dma_buf *dmabuf)
if (WARN_ON(!dmabuf || !dmabuf->file))
return;
fput(dmabuf->file);
DMA_BUF_TRACE(trace_dma_buf_put, dmabuf);
fput(dmabuf->file);
}
EXPORT_SYMBOL_NS_GPL(dma_buf_put, "DMA_BUF");

4
drivers/dma-buf/dma-fence.c
View File

@ -1037,8 +1037,8 @@ EXPORT_SYMBOL(dma_fence_set_deadline);
*/
void dma_fence_describe(struct dma_fence *fence, struct seq_file *seq)
{
const char __rcu *timeline = "";
const char __rcu *driver = "";
const char __rcu *timeline = (const char __rcu *)"";
const char __rcu *driver = (const char __rcu *)"";
const char *signaled = "";
rcu_read_lock();

6
drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
View File

@ -345,10 +345,14 @@ static int dw_mipi_dsi_host_attach(struct mipi_dsi_host *host,
if (pdata->host_ops && pdata->host_ops->attach) {
ret = pdata->host_ops->attach(pdata->priv_data, device);
if (ret < 0)
return ret;
goto err_remove_bridge;
}
return 0;
err_remove_bridge:
drm_bridge_remove(&dsi->bridge);
return ret;
}
static int dw_mipi_dsi_host_detach(struct mipi_dsi_host *host,

6
drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi2.c
View File

@ -540,10 +540,14 @@ static int dw_mipi_dsi2_host_attach(struct mipi_dsi_host *host,
if (pdata->host_ops && pdata->host_ops->attach) {
ret = pdata->host_ops->attach(pdata->priv_data, device);
if (ret < 0)
return ret;
goto err_remove_bridge;
}
return 0;
err_remove_bridge:
drm_bridge_remove(&dsi2->bridge);
return ret;
}
static int dw_mipi_dsi2_host_detach(struct mipi_dsi_host *host,

14
drivers/gpu/drm/drm_atomic_helper.c
View File

@ -1916,7 +1916,7 @@ drm_atomic_helper_wait_for_vblanks(struct drm_device *dev,
ret = wait_event_timeout(*queue,
state->crtcs[i].last_vblank_count !=
drm_crtc_vblank_count(crtc),
msecs_to_jiffies(100));
msecs_to_jiffies(1000));
WARN(!ret, "[CRTC:%d:%s] vblank wait timed out\n",
crtc->base.id, crtc->name);
@ -3751,6 +3751,13 @@ drm_atomic_helper_duplicate_state(struct drm_device *dev,
err = PTR_ERR(plane_state);
goto free;
}
if (plane_state->color_pipeline) {
err = drm_atomic_add_affected_colorops(state, plane);
if (err)
goto free;
}
}
drm_connector_list_iter_begin(dev, &conn_iter);
@ -3856,6 +3863,8 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
int i, ret;
struct drm_plane *plane;
struct drm_plane_state *new_plane_state;
struct drm_colorop *colorop;
struct drm_colorop_state *new_colorop_state;
struct drm_connector *connector;
struct drm_connector_state *new_conn_state;
struct drm_crtc *crtc;
@ -3863,6 +3872,9 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
state->acquire_ctx = ctx;
for_each_new_colorop_in_state(state, colorop, new_colorop_state, i)
state->colorops[i].old_state = colorop->state;
for_each_new_plane_in_state(state, plane, new_plane_state, i)
state->planes[i].old_state = plane->state;

2
drivers/gpu/drm/nouveau/nouveau_drm.c
View File

@ -875,7 +875,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
/* Remove conflicting drivers (vesafb, efifb etc). */
ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name);
if (ret)
return ret;
goto fail_nvkm;
pci_set_master(pdev);

2
drivers/gpu/drm/nouveau/nouveau_gem.c
View File

@ -686,7 +686,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
}
nvbo = (void *)(unsigned long)bo[r->reloc_bo_index].user_priv;
if (unlikely(r->reloc_bo_offset + 4 >
if (unlikely((u64)r->reloc_bo_offset + 4 >
nvbo->bo.base.size)) {
NV_PRINTK(err, cli, "reloc outside of bo\n");
ret = -EINVAL;

2
drivers/gpu/drm/panel/panel-visionox-rm69299.c
View File

@ -376,6 +376,8 @@ static int visionox_rm69299_probe(struct mipi_dsi_device *dsi)
return PTR_ERR(ctx->reset_gpio);
}
ctx->panel.prepare_prev_first = true;
ctx->panel.backlight = visionox_rm69299_create_backlight(ctx);
if (IS_ERR(ctx->panel.backlight))
return dev_err_probe(dev, PTR_ERR(ctx->panel.backlight),

2
drivers/gpu/drm/panthor/panthor_gem.c
View File

@ -157,7 +157,7 @@ void panthor_kernel_bo_destroy(struct panthor_kernel_bo *bo)
/**
* panthor_kernel_bo_create() - Create and map a GEM object to a VM
* @ptdev: Device.
* @vm: VM to map the GEM to. If NULL, the kernel object is not GPU mapped.
* @vm: VM to map the GEM to.
* @size: Size of the buffer object.
* @bo_flags: Combination of drm_panthor_bo_flags flags.
* @vm_map_flags: Combination of drm_panthor_vm_bind_op_flags (only those

19
drivers/gpu/drm/panthor/panthor_mmu.c
View File

@ -1648,6 +1648,25 @@ static int panthor_vm_lock_region(struct panthor_vm *vm, u64 start, u64 size)
start + size <= vm->locked_region.start + vm->locked_region.size)
return 0;
/* sm_step_remap() may need a locked region that isn't a strict superset
* of the original one because of having to extend unmap boundaries beyond
* it to deal with partial unmaps of transparent huge pages. What we want
* in those cases is to lock the union of both regions. The new region must
* always overlap with the original one, because the upper and lower unmap
* boundaries in a remap operation can only shift up or down respectively,
* but never otherwise.
*/
if (vm->locked_region.size) {
u64 end = max(vm->locked_region.start + vm->locked_region.size,
start + size);
drm_WARN_ON_ONCE(&vm->ptdev->base, (start + size <= vm->locked_region.start) ||
(start >= vm->locked_region.start + vm->locked_region.size));
start = min(start, vm->locked_region.start);
size = end - start;
}
mutex_lock(&ptdev->mmu->as.slots_lock);
if (vm->as.id >= 0 && size) {
/* Lock the region that needs to be updated */

6
drivers/gpu/drm/stm/lvds.c
View File

@ -897,14 +897,14 @@ static int lvds_connector_atomic_check(struct drm_connector *connector,
if (!conn_state)
return -EINVAL;
if (!conn_state->crtc)
return 0;
if (list_empty(&connector->modes)) {
drm_dbg(connector->dev, "connector: empty modes list\n");
return -EINVAL;
}
if (!conn_state->crtc)
return -EINVAL;
panel_mode = list_first_entry(&connector->modes,
struct drm_display_mode, head);

3
drivers/gpu/drm/tiny/arcpgu.c
View File

@ -250,7 +250,8 @@ DEFINE_DRM_GEM_DMA_FOPS(arcpgu_drm_ops);
static int arcpgu_load(struct arcpgu_drm_private *arcpgu)
{
struct platform_device *pdev = to_platform_device(arcpgu->drm.dev);
struct device_node *encoder_node = NULL, *endpoint_node = NULL;
struct device_node *encoder_node __free(device_node) = NULL;
struct device_node *endpoint_node = NULL;
struct drm_connector *connector = NULL;
struct drm_device *drm = &arcpgu->drm;
int ret;

5
drivers/gpu/drm/v3d/v3d_submit.c
View File

@ -399,6 +399,11 @@ v3d_get_multisync_submit_deps(struct drm_file *file_priv,
if (multisync.pad)
return -EINVAL;
if (!multisync.in_sync_count && !multisync.out_sync_count) {
drm_dbg(&v3d->drm, "Empty multisync extension\n");
return -EINVAL;
}
ret = v3d_get_multisync_post_deps(file_priv, se, multisync.out_sync_count,
multisync.out_syncs);
if (ret)

2
drivers/hv/Kconfig
View File

@ -9,7 +9,6 @@ config HYPERV
select PARAVIRT
select X86_HV_CALLBACK_VECTOR if X86
select OF_EARLY_FLATTREE if OF
select SYSFB if EFI && !HYPERV_VTL_MODE
select IRQ_MSI_LIB if X86
help
Select this option to run Linux as a Hyper-V client operating
@ -62,6 +61,7 @@ config HYPERV_VMBUS
tristate "Microsoft Hyper-V VMBus driver"
depends on HYPERV
default HYPERV
select SYSFB if EFI && !HYPERV_VTL_MODE
help
Select this option to enable Hyper-V Vmbus driver.

3
include/drm/drm_atomic.h
View File

@ -1101,7 +1101,8 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p);
for_each_if ((__state)->colorops[__i].ptr && \
((colorop) = (__state)->colorops[__i].ptr, \
(void)(colorop) /* Only to avoid unused-but-set-variable warning */, \
(new_colorop_state) = (__state)->colorops[__i].new_state, 1))
(new_colorop_state) = (__state)->colorops[__i].new_state,\
(void)(new_colorop_state) /* Only to avoid unused-but-set-variable warning */, 1))
/**
* for_each_oldnew_plane_in_state - iterate over all planes in an atomic update