Josh Boyer
parent
2464bd0900
commit
1654466ce9
|
|
@ -1,97 +0,0 @@
|
|||
From: Josh Boyer <jwboyer@fedoraproject.org>
|
||||
Date: Mon, 23 Mar 2015 13:50:33 -0400
|
||||
Subject: [PATCH] Revert "drm/i915: Ensure plane->state->fb stays in sync with
|
||||
plane->fb"
|
||||
|
||||
This reverts commit 319c1d420a0b62d9dbb88104afebaabc968cdbfa.
|
||||
---
|
||||
drivers/gpu/drm/i915/intel_display.c | 17 -----------------
|
||||
1 file changed, 17 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
|
||||
index e116dee10cf9..ac8112d86237 100644
|
||||
--- a/drivers/gpu/drm/i915/intel_display.c
|
||||
+++ b/drivers/gpu/drm/i915/intel_display.c
|
||||
@@ -37,7 +37,6 @@
|
||||
#include <drm/i915_drm.h>
|
||||
#include "i915_drv.h"
|
||||
#include "i915_trace.h"
|
||||
-#include <drm/drm_atomic.h>
|
||||
#include <drm/drm_atomic_helper.h>
|
||||
#include <drm/drm_dp_helper.h>
|
||||
#include <drm/drm_crtc_helper.h>
|
||||
@@ -2417,14 +2416,6 @@ out_unref_obj:
|
||||
return false;
|
||||
}
|
||||
|
||||
-/* Update plane->state->fb to match plane->fb after driver-internal updates */
|
||||
-static void
|
||||
-update_state_fb(struct drm_plane *plane)
|
||||
-{
|
||||
- if (plane->fb != plane->state->fb)
|
||||
- drm_atomic_set_fb_for_plane(plane->state, plane->fb);
|
||||
-}
|
||||
-
|
||||
static void
|
||||
intel_find_plane_obj(struct intel_crtc *intel_crtc,
|
||||
struct intel_initial_plane_config *plane_config)
|
||||
@@ -2471,8 +2462,6 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
|
||||
break;
|
||||
}
|
||||
}
|
||||
-
|
||||
- update_state_fb(intel_crtc->base.primary);
|
||||
}
|
||||
|
||||
static void i9xx_update_primary_plane(struct drm_crtc *crtc,
|
||||
@@ -6663,7 +6652,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
|
||||
plane_config->size);
|
||||
|
||||
crtc->base.primary->fb = fb;
|
||||
- update_state_fb(crtc->base.primary);
|
||||
}
|
||||
|
||||
static void chv_crtc_clock_get(struct intel_crtc *crtc,
|
||||
@@ -7704,7 +7692,6 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
|
||||
plane_config->size);
|
||||
|
||||
crtc->base.primary->fb = fb;
|
||||
- update_state_fb(crtc->base.primary);
|
||||
return;
|
||||
|
||||
error:
|
||||
@@ -7798,7 +7785,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
|
||||
plane_config->size);
|
||||
|
||||
crtc->base.primary->fb = fb;
|
||||
- update_state_fb(crtc->base.primary);
|
||||
}
|
||||
|
||||
static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
|
||||
@@ -9837,7 +9823,6 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
|
||||
drm_gem_object_reference(&obj->base);
|
||||
|
||||
crtc->primary->fb = fb;
|
||||
- update_state_fb(crtc->primary);
|
||||
|
||||
work->pending_flip_obj = obj;
|
||||
|
||||
@@ -9906,7 +9891,6 @@ cleanup_unpin:
|
||||
cleanup_pending:
|
||||
atomic_dec(&intel_crtc->unpin_work_count);
|
||||
crtc->primary->fb = old_fb;
|
||||
- update_state_fb(crtc->primary);
|
||||
drm_gem_object_unreference(&work->old_fb_obj->base);
|
||||
drm_gem_object_unreference(&obj->base);
|
||||
mutex_unlock(&dev->struct_mutex);
|
||||
@@ -13741,7 +13725,6 @@ void intel_modeset_gem_init(struct drm_device *dev)
|
||||
to_intel_crtc(c)->pipe);
|
||||
drm_framebuffer_unreference(c->primary->fb);
|
||||
c->primary->fb = NULL;
|
||||
- update_state_fb(c->primary);
|
||||
}
|
||||
}
|
||||
mutex_unlock(&dev->struct_mutex);
|
||||
--
|
||||
2.1.0
|
||||
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
From: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||||
Date: Fri, 27 Feb 2015 12:58:13 +0100
|
||||
Subject: [PATCH] drm: Fixup racy refcounting in plane_force_disable
|
||||
|
||||
Originally it was impossible to be dropping the last refcount in this
|
||||
function since there was always one around still from the idr. But in
|
||||
|
||||
commit 83f45fc360c8e16a330474860ebda872d1384c8c
|
||||
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||||
Date: Wed Aug 6 09:10:18 2014 +0200
|
||||
|
||||
drm: Don't grab an fb reference for the idr
|
||||
|
||||
we've switched to weak references, broke that assumption but forgot to
|
||||
fix it up.
|
||||
|
||||
Since we still force-disable planes it's only possible to hit this
|
||||
when racing multiple rmfb with fbdev restoring or similar evil things.
|
||||
As long as userspace is nice it's impossible to hit the BUG_ON.
|
||||
|
||||
But the BUG_ON would most likely be hit from fbdev code, which usually
|
||||
invovles the console_lock besides all modeset locks. So very likely
|
||||
we'd never get the bug reports if this was hit in the wild, hence
|
||||
better be safe than sorry and backport.
|
||||
|
||||
Spotted by Matt Roper while reviewing other patches.
|
||||
|
||||
[airlied: pull this back into 4.0 - the oops happens there]
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Cc: Matt Roper <matthew.d.roper@intel.com>
|
||||
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
|
||||
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
|
||||
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
||||
---
|
||||
drivers/gpu/drm/drm_crtc.c | 13 +------------
|
||||
1 file changed, 1 insertion(+), 12 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
|
||||
index f6d04c7b5115..679b10e34fb5 100644
|
||||
--- a/drivers/gpu/drm/drm_crtc.c
|
||||
+++ b/drivers/gpu/drm/drm_crtc.c
|
||||
@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
|
||||
}
|
||||
EXPORT_SYMBOL(drm_framebuffer_reference);
|
||||
|
||||
-static void drm_framebuffer_free_bug(struct kref *kref)
|
||||
-{
|
||||
- BUG();
|
||||
-}
|
||||
-
|
||||
-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
|
||||
-{
|
||||
- DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
|
||||
- kref_put(&fb->refcount, drm_framebuffer_free_bug);
|
||||
-}
|
||||
-
|
||||
/**
|
||||
* drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
|
||||
* @fb: fb to unregister
|
||||
@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
|
||||
return;
|
||||
}
|
||||
/* disconnect the plane from the fb and crtc: */
|
||||
- __drm_framebuffer_unreference(plane->old_fb);
|
||||
+ drm_framebuffer_unreference(plane->old_fb);
|
||||
plane->old_fb = NULL;
|
||||
plane->fb = NULL;
|
||||
plane->crtc = NULL;
|
||||
--
|
||||
2.1.0
|
||||
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
From: Damien Lespiau <damien.lespiau@intel.com>
|
||||
Date: Thu, 5 Feb 2015 18:30:20 +0000
|
||||
Subject: [PATCH] drm/i915: Don't try to reference the fb in
|
||||
get_initial_plane_config()
|
||||
|
||||
Tvrtko noticed a new warning on boot:
|
||||
|
||||
WARNING: CPU: 1 PID: 353 at include/linux/kref.h:47 drm_framebuffer_reference+0x6c/0x80 [drm]()
|
||||
Call Trace:
|
||||
[<ffffffff8161f10c>] dump_stack+0x4f/0x7b
|
||||
[<ffffffff81052caa>] warn_slowpath_common+0xaa/0xd0
|
||||
[<ffffffff81052d8a>] warn_slowpath_null+0x1a/0x20
|
||||
[<ffffffffa00d035c>] drm_framebuffer_reference+0x6c/0x80 [drm]
|
||||
[<ffffffffa01c0df7>] update_state_fb.isra.54+0x47/0x50 [i915]
|
||||
[<ffffffffa01ccd5c>] skylake_get_initial_plane_config+0x93c/0x950 [i915]
|
||||
[<ffffffffa01e8721>] intel_modeset_init+0x1551/0x17c0 [i915]
|
||||
[<ffffffffa02476e0>] i915_driver_load+0xed0/0x11e0 [i915]
|
||||
[<ffffffff81627aa1>] ? _raw_spin_unlock_irqrestore+0x51/0x70
|
||||
[<ffffffffa00ca8b7>] drm_dev_register+0x77/0x110 [drm]
|
||||
[<ffffffffa00cda3b>] drm_get_pci_dev+0x11b/0x1f0 [drm]
|
||||
[<ffffffff81098e3d>] ? trace_hardirqs_on+0xd/0x10
|
||||
[<ffffffff81627aa1>] ? _raw_spin_unlock_irqrestore+0x51/0x70
|
||||
[<ffffffffa0145276>] i915_pci_probe+0x56/0x60 [i915]
|
||||
[<ffffffff813ad59c>] pci_device_probe+0x7c/0x100
|
||||
[<ffffffff81466aad>] driver_probe_device+0x16d/0x380
|
||||
|
||||
We cannot take a reference at this point, not before
|
||||
intel_framebuffer_init() and the underlying drm_framebuffer_init().
|
||||
|
||||
Introduced in:
|
||||
|
||||
commit 706dc7b549175e47f23e913b7f1e52874a7d0f56
|
||||
Author: Matt Roper <matthew.d.roper@intel.com>
|
||||
Date: Tue Feb 3 13:10:04 2015 -0800
|
||||
|
||||
drm/i915: Ensure plane->state->fb stays in sync with plane->fb
|
||||
|
||||
v2: Don't move update_state_fb(). It was moved around because I
|
||||
originally put update_state_fb() in intel_alloc_plane_obj() before
|
||||
finding a better place. (Matt)
|
||||
|
||||
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
|
||||
Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
|
||||
Cc: Matt Roper <matthew.d.roper@intel.com>
|
||||
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
|
||||
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
|
||||
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
|
||||
---
|
||||
drivers/gpu/drm/i915/intel_display.c | 7 +++----
|
||||
1 file changed, 3 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
|
||||
index e116dee10cf9..177714a9d778 100644
|
||||
--- a/drivers/gpu/drm/i915/intel_display.c
|
||||
+++ b/drivers/gpu/drm/i915/intel_display.c
|
||||
@@ -2438,8 +2438,10 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
|
||||
if (!intel_crtc->base.primary->fb)
|
||||
return;
|
||||
|
||||
- if (intel_alloc_plane_obj(intel_crtc, plane_config))
|
||||
+ if (intel_alloc_plane_obj(intel_crtc, plane_config)) {
|
||||
+ update_state_fb(intel_crtc->base.primary);
|
||||
return;
|
||||
+ }
|
||||
|
||||
kfree(intel_crtc->base.primary->fb);
|
||||
intel_crtc->base.primary->fb = NULL;
|
||||
@@ -6663,7 +6665,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
|
||||
plane_config->size);
|
||||
|
||||
crtc->base.primary->fb = fb;
|
||||
- update_state_fb(crtc->base.primary);
|
||||
}
|
||||
|
||||
static void chv_crtc_clock_get(struct intel_crtc *crtc,
|
||||
@@ -7704,7 +7705,6 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
|
||||
plane_config->size);
|
||||
|
||||
crtc->base.primary->fb = fb;
|
||||
- update_state_fb(crtc->base.primary);
|
||||
return;
|
||||
|
||||
error:
|
||||
@@ -7798,7 +7798,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
|
||||
plane_config->size);
|
||||
|
||||
crtc->base.primary->fb = fb;
|
||||
- update_state_fb(crtc->base.primary);
|
||||
}
|
||||
|
||||
static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
|
||||
--
|
||||
2.1.0
|
||||
|
||||
16
kernel.spec
16
kernel.spec
|
|
@ -68,7 +68,7 @@ Summary: The Linux kernel
|
|||
# The rc snapshot level
|
||||
%define rcrev 5
|
||||
# The git snapshot level
|
||||
%define gitrev 0
|
||||
%define gitrev 1
|
||||
# Set rpm version accordingly
|
||||
%define rpmversion 4.%{upstream_sublevel}.0
|
||||
%endif
|
||||
|
|
@ -627,9 +627,8 @@ Patch26168: HID-multitouch-add-support-of-clickpads.patch
|
|||
Patch26170: acpi-video-Allow-forcing-native-backlight-on-non-win.patch
|
||||
Patch26171: acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
|
||||
|
||||
Patch26172: Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch
|
||||
|
||||
Patch26173: net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
|
||||
Patch26172: drm-Fixup-racy-refcounting-in-plane_force_disable.patch
|
||||
Patch26173: drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
|
|
@ -1369,9 +1368,8 @@ ApplyPatch HID-multitouch-add-support-of-clickpads.patch
|
|||
ApplyPatch acpi-video-Allow-forcing-native-backlight-on-non-win.patch
|
||||
ApplyPatch acpi-video-Add-force-native-backlight-quirk-for-Leno.patch
|
||||
|
||||
ApplyPatch Revert-drm-i915-Ensure-plane-state-fb-stays-in-sync-.patch
|
||||
|
||||
ApplyPatch net-validate-the-range-we-feed-to-iov_iter_init-in-s.patch
|
||||
ApplyPatch drm-Fixup-racy-refcounting-in-plane_force_disable.patch
|
||||
ApplyPatch drm-i915-Don-t-try-to-reference-the-fb-in-get_initia.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
|
|
@ -2223,6 +2221,10 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Tue Mar 24 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc5.git1.3
|
||||
- Linux v4.0-rc5-25-g90a5a895cc8b
|
||||
- Add some i915 fixes
|
||||
|
||||
* Mon Mar 23 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc5.git0.3
|
||||
- Enable CONFIG_SND_BEBOB (rhbz 1204342)
|
||||
- Validate iovec range in sys_sendto/sys_recvfrom
|
||||
|
|
|
|||
|
|
@ -1,37 +0,0 @@
|
|||
From: Al Viro <viro@ZenIV.linux.org.uk>
|
||||
Date: Fri, 20 Mar 2015 17:41:43 +0000
|
||||
Subject: [PATCH] net: validate the range we feed to iov_iter_init() in
|
||||
sys_sendto/sys_recvfrom
|
||||
|
||||
Cc: stable@vger.kernel.org # v3.19
|
||||
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/socket.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/net/socket.c b/net/socket.c
|
||||
index bbedbfcb42c2..245330ca0015 100644
|
||||
--- a/net/socket.c
|
||||
+++ b/net/socket.c
|
||||
@@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
|
||||
|
||||
if (len > INT_MAX)
|
||||
len = INT_MAX;
|
||||
+ if (unlikely(!access_ok(VERIFY_READ, buff, len)))
|
||||
+ return -EFAULT;
|
||||
sock = sockfd_lookup_light(fd, &err, &fput_needed);
|
||||
if (!sock)
|
||||
goto out;
|
||||
@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
|
||||
|
||||
if (size > INT_MAX)
|
||||
size = INT_MAX;
|
||||
+ if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
|
||||
+ return -EFAULT;
|
||||
sock = sockfd_lookup_light(fd, &err, &fput_needed);
|
||||
if (!sock)
|
||||
goto out;
|
||||
--
|
||||
2.1.0
|
||||
|
||||
Loading…
Reference in New Issue