Merge tag 'drm-misc-fixes-2023-11-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

drm-misc-fixes for v6.7-rc1:

qxl:
- qxl memory leak fix.
syncobj:
- Fix waiting for DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
vc4:
- Fix UAF in mock helpers

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
[sima: Stitch together both changelogs from Maarten. Also because of
branch history this contains a few more bugfixes which are already in
v6.6, but I didn't feel like this justifies some backmerge since there
wasn't any real conflict.]
Link: https://patchwork.freedesktop.org/patch/msgid/bc8598ee-d427-4616-8ebd-64107ab9a2d8@linux.intel.com
This commit is contained in:
Daniel Vetter 2023-11-10 16:54:41 +01:00
commit aec3e2e23b
10 changed files with 28 additions and 21 deletions

View File

@ -906,9 +906,6 @@ static u32 ivpu_hw_37xx_irqb_handler(struct ivpu_device *vdev, int irq)
if (status == 0) if (status == 0)
return 0; return 0;
/* Disable global interrupt before handling local buttress interrupts */
REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x1);
if (REG_TEST_FLD(VPU_37XX_BUTTRESS_INTERRUPT_STAT, FREQ_CHANGE, status)) if (REG_TEST_FLD(VPU_37XX_BUTTRESS_INTERRUPT_STAT, FREQ_CHANGE, status))
ivpu_dbg(vdev, IRQ, "FREQ_CHANGE irq: %08x", ivpu_dbg(vdev, IRQ, "FREQ_CHANGE irq: %08x",
REGB_RD32(VPU_37XX_BUTTRESS_CURRENT_PLL)); REGB_RD32(VPU_37XX_BUTTRESS_CURRENT_PLL));
@ -940,9 +937,6 @@ static u32 ivpu_hw_37xx_irqb_handler(struct ivpu_device *vdev, int irq)
else else
REGB_WR32(VPU_37XX_BUTTRESS_INTERRUPT_STAT, status); REGB_WR32(VPU_37XX_BUTTRESS_INTERRUPT_STAT, status);
/* Re-enable global interrupt */
REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x0);
if (schedule_recovery) if (schedule_recovery)
ivpu_pm_schedule_recovery(vdev); ivpu_pm_schedule_recovery(vdev);
@ -954,9 +948,14 @@ static irqreturn_t ivpu_hw_37xx_irq_handler(int irq, void *ptr)
struct ivpu_device *vdev = ptr; struct ivpu_device *vdev = ptr;
u32 ret_irqv, ret_irqb; u32 ret_irqv, ret_irqb;
REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x1);
ret_irqv = ivpu_hw_37xx_irqv_handler(vdev, irq); ret_irqv = ivpu_hw_37xx_irqv_handler(vdev, irq);
ret_irqb = ivpu_hw_37xx_irqb_handler(vdev, irq); ret_irqb = ivpu_hw_37xx_irqb_handler(vdev, irq);
/* Re-enable global interrupts to re-trigger MSI for pending interrupts */
REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x0);
return IRQ_RETVAL(ret_irqb | ret_irqv); return IRQ_RETVAL(ret_irqb | ret_irqv);
} }

View File

@ -1144,7 +1144,7 @@ static int reserve_bo_and_vm(struct kgd_mem *mem,
if (unlikely(ret)) if (unlikely(ret))
goto error; goto error;
ret = drm_exec_lock_obj(&ctx->exec, &bo->tbo.base); ret = drm_exec_prepare_obj(&ctx->exec, &bo->tbo.base, 1);
drm_exec_retry_on_contention(&ctx->exec); drm_exec_retry_on_contention(&ctx->exec);
if (unlikely(ret)) if (unlikely(ret))
goto error; goto error;

View File

@ -65,7 +65,8 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p,
} }
amdgpu_sync_create(&p->sync); amdgpu_sync_create(&p->sync);
drm_exec_init(&p->exec, DRM_EXEC_INTERRUPTIBLE_WAIT); drm_exec_init(&p->exec, DRM_EXEC_INTERRUPTIBLE_WAIT |
DRM_EXEC_IGNORE_DUPLICATES);
return 0; return 0;
} }

View File

@ -56,6 +56,10 @@ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
return true; return true;
default: default:
case AMDGPU_CTX_PRIORITY_UNSET: case AMDGPU_CTX_PRIORITY_UNSET:
/* UNSET priority is not valid and we don't carry that
* around, but set it to NORMAL in the only place this
* function is called, amdgpu_ctx_ioctl().
*/
return false; return false;
} }
} }
@ -96,9 +100,6 @@ amdgpu_ctx_to_drm_sched_prio(int32_t ctx_prio)
static int amdgpu_ctx_priority_permit(struct drm_file *filp, static int amdgpu_ctx_priority_permit(struct drm_file *filp,
int32_t priority) int32_t priority)
{ {
if (!amdgpu_ctx_priority_is_valid(priority))
return -EINVAL;
/* NORMAL and below are accessible by everyone */ /* NORMAL and below are accessible by everyone */
if (priority <= AMDGPU_CTX_PRIORITY_NORMAL) if (priority <= AMDGPU_CTX_PRIORITY_NORMAL)
return 0; return 0;
@ -633,8 +634,6 @@ static int amdgpu_ctx_query2(struct amdgpu_device *adev,
return 0; return 0;
} }
static int amdgpu_ctx_stable_pstate(struct amdgpu_device *adev, static int amdgpu_ctx_stable_pstate(struct amdgpu_device *adev,
struct amdgpu_fpriv *fpriv, uint32_t id, struct amdgpu_fpriv *fpriv, uint32_t id,
bool set, u32 *stable_pstate) bool set, u32 *stable_pstate)
@ -677,8 +676,10 @@ int amdgpu_ctx_ioctl(struct drm_device *dev, void *data,
id = args->in.ctx_id; id = args->in.ctx_id;
priority = args->in.priority; priority = args->in.priority;
/* For backwards compatibility reasons, we need to accept /* For backwards compatibility, we need to accept ioctls with garbage
* ioctls with garbage in the priority field */ * in the priority field. Garbage values in the priority field, result
* in the priority being set to NORMAL.
*/
if (!amdgpu_ctx_priority_is_valid(priority)) if (!amdgpu_ctx_priority_is_valid(priority))
priority = AMDGPU_CTX_PRIORITY_NORMAL; priority = AMDGPU_CTX_PRIORITY_NORMAL;

View File

@ -2574,14 +2574,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper(
struct drm_dp_mst_branch *found_mstb; struct drm_dp_mst_branch *found_mstb;
struct drm_dp_mst_port *port; struct drm_dp_mst_port *port;
if (!mstb)
return NULL;
if (memcmp(mstb->guid, guid, 16) == 0) if (memcmp(mstb->guid, guid, 16) == 0)
return mstb; return mstb;
list_for_each_entry(port, &mstb->ports, next) { list_for_each_entry(port, &mstb->ports, next) {
if (!port->mstb)
continue;
found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid); found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid);
if (found_mstb) if (found_mstb)

View File

@ -1069,7 +1069,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
fence = drm_syncobj_fence_get(syncobjs[i]); fence = drm_syncobj_fence_get(syncobjs[i]);
if (!fence || dma_fence_chain_find_seqno(&fence, points[i])) { if (!fence || dma_fence_chain_find_seqno(&fence, points[i])) {
dma_fence_put(fence); dma_fence_put(fence);
if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) { if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
continue; continue;
} else { } else {
timeout = -EINVAL; timeout = -EINVAL;

View File

@ -5,5 +5,7 @@ config DRM_LOGICVC
select DRM_KMS_HELPER select DRM_KMS_HELPER
select DRM_KMS_DMA_HELPER select DRM_KMS_DMA_HELPER
select DRM_GEM_DMA_HELPER select DRM_GEM_DMA_HELPER
select REGMAP
select REGMAP_MMIO
help help
DRM display driver for the logiCVC programmable logic block from Xylon DRM display driver for the logiCVC programmable logic block from Xylon

View File

@ -1229,6 +1229,9 @@ int qxl_destroy_monitors_object(struct qxl_device *qdev)
if (!qdev->monitors_config_bo) if (!qdev->monitors_config_bo)
return 0; return 0;
kfree(qdev->dumb_heads);
qdev->dumb_heads = NULL;
qdev->monitors_config = NULL; qdev->monitors_config = NULL;
qdev->ram_header->monitors_config = 0; qdev->ram_header->monitors_config = 0;

View File

@ -26,7 +26,7 @@ struct vc4_dummy_crtc *vc4_mock_pv(struct kunit *test,
struct vc4_crtc *vc4_crtc; struct vc4_crtc *vc4_crtc;
int ret; int ret;
dummy_crtc = kunit_kzalloc(test, sizeof(*dummy_crtc), GFP_KERNEL); dummy_crtc = drmm_kzalloc(drm, sizeof(*dummy_crtc), GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, dummy_crtc); KUNIT_ASSERT_NOT_NULL(test, dummy_crtc);
vc4_crtc = &dummy_crtc->crtc; vc4_crtc = &dummy_crtc->crtc;

View File

@ -32,7 +32,7 @@ struct vc4_dummy_output *vc4_dummy_output(struct kunit *test,
struct drm_encoder *enc; struct drm_encoder *enc;
int ret; int ret;
dummy_output = kunit_kzalloc(test, sizeof(*dummy_output), GFP_KERNEL); dummy_output = drmm_kzalloc(drm, sizeof(*dummy_output), GFP_KERNEL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_output); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_output);
dummy_output->encoder.type = vc4_encoder_type; dummy_output->encoder.type = vc4_encoder_type;