Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a679286 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-next-fixes-2019-04-24' of... 

Merge tag 'drm-misc-next-fixes-2019-04-24' of git://anongit.freedesktop.org/drm/drm-misc

 into drm-next

- fb_helper: Fix NULL deref in legacy drivers (Noralf)
- leases: Ensure lessees can't connect to objects outside their perview (Daniel)
- leases: Enforce that lessees hold the lease for implicitly set planes (Daniel)
- leases: A few non-functional cleanups (Daniel)

Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Sean Paul <sean@poorly.run>
Link: https://patchwork.freedesktop.org/patch/msgid/20190424210604.GA32581@art_vandelay
parents 08269364 1de72592

drivers/gpu/drm/drm_atomic_uapi.c

+23 −13
Original line number Diff line number Diff line
@@ -512,8 +512,8 @@ drm_atomic_crtc_get_property(struct drm_crtc *crtc, 
}



static int drm_atomic_plane_set_property(struct drm_plane *plane,

		struct drm_plane_state *state, struct drm_property *property,

		uint64_t val)

		struct drm_plane_state *state, struct drm_file *file_priv,

		struct drm_property *property, uint64_t val)

{

	struct drm_device *dev = plane->dev;

	struct drm_mode_config *config = &dev->mode_config;
@@ -521,7 +521,8 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane, 
	int ret;



	if (property == config->prop_fb_id) {

		struct drm_framebuffer *fb = drm_framebuffer_lookup(dev, NULL, val);

		struct drm_framebuffer *fb;

		fb = drm_framebuffer_lookup(dev, file_priv, val);

		drm_atomic_set_fb_for_plane(state, fb);

		if (fb)

			drm_framebuffer_put(fb);
@@ -537,7 +538,9 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane, 
			return -EINVAL;



	} else if (property == config->prop_crtc_id) {

		struct drm_crtc *crtc = drm_crtc_find(dev, NULL, val);

		struct drm_crtc *crtc = drm_crtc_find(dev, file_priv, val);

		if (val && !crtc)

			return -EACCES;

		return drm_atomic_set_crtc_for_plane(state, crtc);

	} else if (property == config->prop_crtc_x) {

		state->crtc_x = U642I64(val);
@@ -668,14 +671,16 @@ static int drm_atomic_set_writeback_fb_for_connector( 
}



static int drm_atomic_connector_set_property(struct drm_connector *connector,

		struct drm_connector_state *state, struct drm_property *property,

		uint64_t val)

		struct drm_connector_state *state, struct drm_file *file_priv,

		struct drm_property *property, uint64_t val)

{

	struct drm_device *dev = connector->dev;

	struct drm_mode_config *config = &dev->mode_config;



	if (property == config->prop_crtc_id) {

		struct drm_crtc *crtc = drm_crtc_find(dev, NULL, val);

		struct drm_crtc *crtc = drm_crtc_find(dev, file_priv, val);

		if (val && !crtc)

			return -EACCES;

		return drm_atomic_set_crtc_for_connector(state, crtc);

	} else if (property == config->dpms_property) {

		/* setting DPMS property requires special handling, which
@@ -736,8 +741,10 @@ static int drm_atomic_connector_set_property(struct drm_connector *connector, 
	} else if (property == connector->colorspace_property) {

		state->colorspace = val;

	} else if (property == config->writeback_fb_id_property) {

		struct drm_framebuffer *fb = drm_framebuffer_lookup(dev, NULL, val);

		int ret = drm_atomic_set_writeback_fb_for_connector(state, fb);

		struct drm_framebuffer *fb;

		int ret;

		fb = drm_framebuffer_lookup(dev, file_priv, val);

		ret = drm_atomic_set_writeback_fb_for_connector(state, fb);

		if (fb)

			drm_framebuffer_put(fb);

		return ret;
@@ -934,6 +941,7 @@ int drm_atomic_connector_commit_dpms(struct drm_atomic_state *state, 
}



int drm_atomic_set_property(struct drm_atomic_state *state,

			    struct drm_file *file_priv,

			    struct drm_mode_object *obj,

			    struct drm_property *prop,

			    uint64_t prop_value)
@@ -956,7 +964,8 @@ int drm_atomic_set_property(struct drm_atomic_state *state, 
		}



		ret = drm_atomic_connector_set_property(connector,

				connector_state, prop, prop_value);

				connector_state, file_priv,

				prop, prop_value);

		break;

	}

	case DRM_MODE_OBJECT_CRTC: {
@@ -984,7 +993,8 @@ int drm_atomic_set_property(struct drm_atomic_state *state, 
		}



		ret = drm_atomic_plane_set_property(plane,

				plane_state, prop, prop_value);

				plane_state, file_priv,

				prop, prop_value);

		break;

	}

	default:
@@ -1354,8 +1364,8 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, 
				goto out;

			}



			ret = drm_atomic_set_property(state, obj, prop,

						      prop_value);

			ret = drm_atomic_set_property(state, file_priv,

						      obj, prop, prop_value);

			if (ret) {

				drm_mode_object_put(obj);

				goto out;

drivers/gpu/drm/drm_auth.c

+0 −2
Original line number Diff line number Diff line
@@ -108,8 +108,6 @@ struct drm_master *drm_master_create(struct drm_device *dev) 
	master->dev = dev;



	/* initialize the tree of output resource lessees */

	master->lessor = NULL;

	master->lessee_id = 0;

	INIT_LIST_HEAD(&master->lessees);

	INIT_LIST_HEAD(&master->lessee_list);

	idr_init(&master->leases);

drivers/gpu/drm/drm_crtc.c

+4 −0
Original line number Diff line number Diff line
@@ -559,6 +559,10 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, 


	plane = crtc->primary;



	/* allow disabling with the primary plane leased */

	if (crtc_req->mode_valid && !drm_lease_held(file_priv, plane->base.id))

		return -EACCES;



	mutex_lock(&crtc->dev->mode_config.mutex);

	DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx,

				   DRM_MODESET_ACQUIRE_INTERRUPTIBLE, ret);

drivers/gpu/drm/drm_crtc_internal.h

+1 −0
Original line number Diff line number Diff line
@@ -214,6 +214,7 @@ int drm_atomic_connector_commit_dpms(struct drm_atomic_state *state, 
				     struct drm_connector *connector,

				     int mode);

int drm_atomic_set_property(struct drm_atomic_state *state,

			    struct drm_file *file_priv,

			    struct drm_mode_object *obj,

			    struct drm_property *prop,

			    uint64_t prop_value);

drivers/gpu/drm/drm_fb_helper.c

+3 −0
Original line number Diff line number Diff line
@@ -2588,6 +2588,9 @@ static bool drm_fb_helper_firmware_config(struct drm_fb_helper *fb_helper, 
	int num_connectors_detected = 0;

	struct drm_modeset_acquire_ctx ctx;



	if (!drm_drv_uses_atomic_modeset(dev))

		return false;



	save_enabled = kcalloc(count, sizeof(bool), GFP_KERNEL);

	if (!save_enabled)

		return false;