Fixes for v5.6:

- Revert allow_fb_modifiers in sun4i, as it causes a regression for DE2 and DE3.
 - Fix null pointer deref in drm_dp_mst_process_up_req().
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAl49Kh8ACgkQ/lWMcqZw
 E8P6rhAAsNKEdG7iZTnqrZzqMLkNdaYdwnAMSIycCSc26UW1xbNAURBWOlxFIyPA
 Jz2eJorXdAZfSzmRIDWV2TetpRGQB7MH+9o4cgG/oTbElOOppKb6S4r86JqYLJrO
 A0NM5juJG/+K5J0uO72ya8HiLqmCaWHl8NMXLe//fhvFYPHO+lFAYzLJ+7tTwDij
 0jNMIH/svVw/HI82jKNeAK/BzIz/POJCjOD5kPEAC9E81KVU8MUlpVEIM3cXaq0w
 wXeTf+uoI83GMik4ZoyAUiUNe3L1vSqoZWKIZESjOGIIvZwHyUgcdmRJwFktu5Qq
 ARqxZhZm4pB/RzN+YEwuSrtS/+gwJzROZFp8HaTIajghed9FT8CI3mnuPS26nnmB
 s+GKg12o/Sgr1uZWyk6ckl42hUqAFgk/H+RFLmW60nC/GtLlZkd1JVIfoA0RjarR
 Ms9RAKL75p4TySncM2vlcZ9GUWHkphEqv9mpm8LLYzAj4yydX6rvGd/QkE+VINyv
 cquhjYrwQU6bojt9kM6Tce1KchYLCt7DTHiXAztnYF8IJG3Ys4Z+xEkp2tM2fE0H
 m++A0GE8eLN5/O00j6relDWagcDTJzt5qjDFIYIiRC2y5EmMdbu1wvOW7sW0LF4l
 1bEuSaZDKfpnlJ3IfqmaWQz7i1553zFmahdfblBIX3hoVqGC6tY=
 =VCDX
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2020-02-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Fixes for v5.6:
- Revert allow_fb_modifiers in sun4i, as it causes a regression for DE2 and DE3.
- Fix null pointer deref in drm_dp_mst_process_up_req().

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/672810c3-4212-0a46-337b-2cb855573fd2@linux.intel.com

drivers/gpu/drm/drm_dp_mst_topology.c

@@ -3838,7 +3838,8 @@ drm_dp_mst_process_up_req(struct drm_dp_mst_topology_mgr *mgr,
 		else if (msg->req_type == DP_RESOURCE_STATUS_NOTIFY)
 			guid = msg->u.resource_stat.guid;
 
-		mstb = drm_dp_get_mst_branch_device_by_guid(mgr, guid);
+		if (guid)
+			mstb = drm_dp_get_mst_branch_device_by_guid(mgr, guid);
 	} else {
 		mstb = drm_dp_get_mst_branch_device(mgr, hdr->lct, hdr->rad);
 	}

drivers/gpu/drm/panfrost/panfrost_drv.c

@@ -166,6 +166,7 @@ panfrost_lookup_bos(struct drm_device *dev,
 			break;
 		}
 
+		atomic_inc(&bo->gpu_usecount);
 		job->mappings[i] = mapping;
 	}
 

drivers/gpu/drm/panfrost/panfrost_gem.h

@@ -30,6 +30,12 @@ struct panfrost_gem_object {
 		struct mutex lock;
 	} mappings;
 
+	/*
+	 * Count the number of jobs referencing this BO so we don't let the
+	 * shrinker reclaim this object prematurely.
+	 */
+	atomic_t gpu_usecount;
+
 	bool noexec		:1;
 	bool is_heap		:1;
 };

drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c

@@ -41,6 +41,9 @@ static bool panfrost_gem_purge(struct drm_gem_object *obj)
 	struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);
 	struct panfrost_gem_object *bo = to_panfrost_bo(obj);
 
+	if (atomic_read(&bo->gpu_usecount))
+		return false;
+
 	if (!mutex_trylock(&shmem->pages_lock))
 		return false;
 

drivers/gpu/drm/panfrost/panfrost_job.c

@@ -269,8 +269,13 @@ static void panfrost_job_cleanup(struct kref *ref)
 	dma_fence_put(job->render_done_fence);
 
 	if (job->mappings) {
-		for (i = 0; i < job->bo_count; i++)
+		for (i = 0; i < job->bo_count; i++) {
+			if (!job->mappings[i])
+				break;
+
+			atomic_dec(&job->mappings[i]->obj->gpu_usecount);
 			panfrost_gem_mapping_put(job->mappings[i]);
+		}
 		kvfree(job->mappings);
 	}
 

drivers/gpu/drm/sun4i/sun4i_drv.c

@@ -85,7 +85,6 @@ static int sun4i_drv_bind(struct device *dev)
 	}
 
 	drm_mode_config_init(drm);
-	drm->mode_config.allow_fb_modifiers = true;
 
 	ret = component_bind_all(drm->dev, drm);
 	if (ret) {