From 7d98404c8162b7f1d1b22eccce92f5ee7f93cab8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Fri, 24 Jul 2020 22:07:18 +0300 Subject: [PATCH 1/9] drm/omap: Use {} to zero initialize the mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first member of drm_display_mode is no longer a structure, but the code is still using {{0}} to zero initialize it. Make that just {} so it works regardless of what lies inside. Cc: Dave Airlie Cc: Laurent Pinchart Cc: Tomi Valkeinen Fixes: 42acb06b01b1 ("drm: pahole struct drm_display_mode") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20200724190718.23567-1-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter --- drivers/gpu/drm/omapdrm/omap_connector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c index 528764566b17..de95dc1b861c 100644 --- a/drivers/gpu/drm/omapdrm/omap_connector.c +++ b/drivers/gpu/drm/omapdrm/omap_connector.c @@ -89,7 +89,7 @@ static enum drm_mode_status omap_connector_mode_valid(struct drm_connector *conn struct drm_display_mode *mode) { struct omap_connector *omap_connector = to_omap_connector(connector); - struct drm_display_mode new_mode = { { 0 } }; + struct drm_display_mode new_mode = {}; enum drm_mode_status status; status = omap_connector_mode_fixup(omap_connector->output, mode, From da3a9e9a6aa96ef589c153078f66e0646bf06b55 Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Thu, 23 Jul 2020 11:05:50 +0200 Subject: [PATCH 2/9] drm/fourcc: fix Amlogic Video Framebuffer Compression macro Fix the Amlogic Video Framebuffer Compression modifier macro to correctly add the layout options, a pair of parenthesis was missing. Fixes: d6528ec88309 ("drm/fourcc: Add modifier definitions for describing Amlogic Video Framebuffer Compression") Signed-off-by: Neil Armstrong Acked-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20200723090551.27529-1-narmstrong@baylibre.com --- include/uapi/drm/drm_fourcc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index 4bee7de5f306..82f327801267 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -1004,7 +1004,7 @@ drm_fourcc_canonicalize_nvidia_format_mod(__u64 modifier) #define DRM_FORMAT_MOD_AMLOGIC_FBC(__layout, __options) \ fourcc_mod_code(AMLOGIC, \ ((__layout) & __fourcc_mod_amlogic_layout_mask) | \ - ((__options) & __fourcc_mod_amlogic_options_mask \ + (((__options) & __fourcc_mod_amlogic_options_mask) \ << __fourcc_mod_amlogic_options_shift)) /* Amlogic FBC Layouts */ From 175233f92e80d09f78be51e5b9abf5ca1fc9dc26 Mon Sep 17 00:00:00 2001 From: Li Heng Date: Thu, 23 Jul 2020 11:27:42 +0800 Subject: [PATCH 3/9] drm: Remove redundant NULL check Fix below warnings reported by coccicheck: ./drivers/gpu/drm/drm_drv.c:819:2-7: WARNING: NULL check before some freeing functions is not needed. Fixes: 5dad34f3c444 ("drm: Cleanups after drmm_add_final_kfree rollout") Signed-off-by: Li Heng Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1595474863-33112-1-git-send-email-liheng40@huawei.com --- drivers/gpu/drm/drm_drv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index bc38322f306e..13068fdf4331 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -815,8 +815,7 @@ static void drm_dev_release(struct kref *ref) drm_managed_release(dev); - if (dev->managed.final_kfree) - kfree(dev->managed.final_kfree); + kfree(dev->managed.final_kfree); } /** From be13d94b7d7f1a3e7290573faa16267941917106 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Fri, 24 Jul 2020 12:12:58 +0100 Subject: [PATCH 4/9] drm: xlnx: fix spelling mistake "failes" -> "failed" There is a spelling mistake in a dev_dbg messages. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Laurent Pinchart Reviewed-by: Hyun Kwon Signed-off-by: Hyun Kwon Link: https://patchwork.freedesktop.org/patch/msgid/20200724111258.14762-1-colin.king@canonical.com --- drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c index 821f7a71e182..0e1c818746eb 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dp.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c @@ -1308,7 +1308,7 @@ zynqmp_dp_connector_detect(struct drm_connector *connector, bool force) ret = drm_dp_dpcd_read(&dp->aux, 0x0, dp->dpcd, sizeof(dp->dpcd)); if (ret < 0) { - dev_dbg(dp->dev, "DPCD read failes"); + dev_dbg(dp->dev, "DPCD read failed"); goto disconnected; } From 2d889db7626d2b6d67f402e2478b11f9a49b44e3 Mon Sep 17 00:00:00 2001 From: Wei Yongjun Date: Sat, 25 Jul 2020 06:34:29 +0000 Subject: [PATCH 5/9] drm: xlnx: Fix typo in parameter description Fix typo in parameter description. Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Reviewed-by: Laurent Pinchart Reviewed-by: Hyun Kwon Signed-off-by: Hyun Kwon Link: https://patchwork.freedesktop.org/patch/msgid/20200725063429.172139-1-weiyongjun1@huawei.com --- drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c index 0e1c818746eb..b735072a702d 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dp.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c @@ -44,7 +44,7 @@ MODULE_PARM_DESC(aux_timeout_ms, "DP aux timeout value in msec (default: 50)"); */ static uint zynqmp_dp_power_on_delay_ms = 4; module_param_named(power_on_delay_ms, zynqmp_dp_power_on_delay_ms, uint, 0444); -MODULE_PARM_DESC(aux_timeout_ms, "DP power on delay in msec (default: 4)"); +MODULE_PARM_DESC(power_on_delay_ms, "DP power on delay in msec (default: 4)"); /* Link configuration registers */ #define ZYNQMP_DP_LINK_BW_SET 0x0 From 70c8b4b8ab3714fb2d075be22aec05ae9c9a6a09 Mon Sep 17 00:00:00 2001 From: Hyun Kwon Date: Wed, 29 Jul 2020 16:30:45 -0700 Subject: [PATCH 6/9] drm: xlnx: zynqmp: Use switch - case for link rate downshift Use switch - case to downshift from the current link rate. It's a small loop now, so fine to be replaced with switch - case. With a loop, it is confusing and hard to follow as reported below. The patch d76271d22694: "drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem" from Jul 7, 2018, leads to the following static checker warning: drivers/gpu/drm/xlnx/zynqmp_dp.c:594 zynqmp_dp_mode_configure() error: iterator underflow 'bws' (-1)-2 Reported-by: Dan Carpenter Signed-off-by: Hyun Kwon Reviewed-by: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/1596065445-4630-1-git-send-email-hyun.kwon@xilinx.com --- drivers/gpu/drm/xlnx/zynqmp_dp.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c index b735072a702d..99158ee67d02 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dp.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c @@ -567,34 +567,37 @@ static int zynqmp_dp_mode_configure(struct zynqmp_dp *dp, int pclock, u8 current_bw) { int max_rate = dp->link_config.max_rate; - u8 bws[3] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7, DP_LINK_BW_5_4 }; + u8 bw_code; u8 max_lanes = dp->link_config.max_lanes; u8 max_link_rate_code = drm_dp_link_rate_to_bw_code(max_rate); u8 bpp = dp->config.bpp; u8 lane_cnt; - s8 i; - if (current_bw == DP_LINK_BW_1_62) { + /* Downshift from current bandwidth */ + switch (current_bw) { + case DP_LINK_BW_5_4: + bw_code = DP_LINK_BW_2_7; + break; + case DP_LINK_BW_2_7: + bw_code = DP_LINK_BW_1_62; + break; + case DP_LINK_BW_1_62: dev_err(dp->dev, "can't downshift. already lowest link rate\n"); return -EINVAL; - } - - for (i = ARRAY_SIZE(bws) - 1; i >= 0; i--) { - if (current_bw && bws[i] >= current_bw) - continue; - - if (bws[i] <= max_link_rate_code) - break; + default: + /* If not given, start with max supported */ + bw_code = max_link_rate_code; + break; } for (lane_cnt = 1; lane_cnt <= max_lanes; lane_cnt <<= 1) { int bw; u32 rate; - bw = drm_dp_bw_code_to_link_rate(bws[i]); + bw = drm_dp_bw_code_to_link_rate(bw_code); rate = zynqmp_dp_max_rate(bw, lane_cnt, bpp); if (pclock <= rate) { - dp->mode.bw_code = bws[i]; + dp->mode.bw_code = bw_code; dp->mode.lane_cnt = lane_cnt; dp->mode.pclock = pclock; return dp->mode.bw_code; From f369bc3f9096f5d355e8b80540bc30ac9a602912 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Sat, 1 Aug 2020 08:17:13 +0200 Subject: [PATCH 7/9] vgaarb: mark vga_tryget static This symbols isn't used anywhere outside of vgaarb.c. Signed-off-by: Christoph Hellwig Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200801061713.307434-1-hch@lst.de --- drivers/gpu/vga/vgaarb.c | 3 +-- include/linux/vgaarb.h | 6 ------ 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index f2f3ef8af271..5180c5687ee5 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -529,7 +529,7 @@ EXPORT_SYMBOL(vga_get); * * 0 on success, negative error code on failure. */ -int vga_tryget(struct pci_dev *pdev, unsigned int rsrc) +static int vga_tryget(struct pci_dev *pdev, unsigned int rsrc) { struct vga_device *vgadev; unsigned long flags; @@ -554,7 +554,6 @@ bail: spin_unlock_irqrestore(&vga_lock, flags); return rc; } -EXPORT_SYMBOL(vga_tryget); /** * vga_put - release lock on legacy VGA resources diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h index 553b34c8b5f7..977caf96c8d2 100644 --- a/include/linux/vgaarb.h +++ b/include/linux/vgaarb.h @@ -109,12 +109,6 @@ static inline int vga_get_uninterruptible(struct pci_dev *pdev, return vga_get(pdev, rsrc, 0); } -#if defined(CONFIG_VGA_ARB) -extern int vga_tryget(struct pci_dev *pdev, unsigned int rsrc); -#else -static inline int vga_tryget(struct pci_dev *pdev, unsigned int rsrc) { return 0; } -#endif - #if defined(CONFIG_VGA_ARB) extern void vga_put(struct pci_dev *pdev, unsigned int rsrc); #else From d88ca7e1a27eb2df056bbf37ddef62e1c73d37ea Mon Sep 17 00:00:00 2001 From: Tetsuo Handa Date: Thu, 30 Jul 2020 19:47:14 +0900 Subject: [PATCH 8/9] fbmem: pull fbcon_update_vcs() out of fb_set_var() syzbot is reporting OOB read bug in vc_do_resize() [1] caused by memcpy() based on outdated old_{rows,row_size} values, for resize_screen() can recurse into vc_do_resize() which changes vc->vc_{cols,rows} that outdates old_{rows,row_size} values which were saved before calling resize_screen(). Daniel Vetter explained that resize_screen() should not recurse into fbcon_update_vcs() path due to FBINFO_MISC_USEREVENT being still set when calling resize_screen(). Instead of masking FBINFO_MISC_USEREVENT before calling fbcon_update_vcs(), we can remove FBINFO_MISC_USEREVENT by calling fbcon_update_vcs() only if fb_set_var() returned 0. This change assumes that it is harmless to call fbcon_update_vcs() when fb_set_var() returned 0 without reaching fb_notifier_call_chain(). [1] https://syzkaller.appspot.com/bug?id=c70c88cfd16dcf6e1d3c7f0ab8648b3144b5b25e Reported-and-tested-by: syzbot Suggested-by: Daniel Vetter Signed-off-by: Tetsuo Handa Reported-by: kernel test robot for missing #include Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/075b7e37-3278-cd7d-31ab-c5073cfa8e92@i-love.sakura.ne.jp --- drivers/video/fbdev/core/fbmem.c | 8 ++------ drivers/video/fbdev/core/fbsysfs.c | 4 ++-- drivers/video/fbdev/ps3fb.c | 5 +++-- include/linux/fb.h | 2 -- 4 files changed, 7 insertions(+), 12 deletions(-) diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index 30e73ec4ad5c..da7c88ffaa6a 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -957,7 +957,6 @@ static int fb_check_caps(struct fb_info *info, struct fb_var_screeninfo *var, int fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) { - int flags = info->flags; int ret = 0; u32 activate; struct fb_var_screeninfo old_var; @@ -1052,9 +1051,6 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) event.data = &mode; fb_notifier_call_chain(FB_EVENT_MODE_CHANGE, &event); - if (flags & FBINFO_MISC_USEREVENT) - fbcon_update_vcs(info, activate & FB_ACTIVATE_ALL); - return 0; } EXPORT_SYMBOL(fb_set_var); @@ -1105,9 +1101,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, return -EFAULT; console_lock(); lock_fb_info(info); - info->flags |= FBINFO_MISC_USEREVENT; ret = fb_set_var(info, &var); - info->flags &= ~FBINFO_MISC_USEREVENT; + if (!ret) + fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL); unlock_fb_info(info); console_unlock(); if (!ret && copy_to_user(argp, &var, sizeof(var))) diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c index d54c88f88991..65dae05fff8e 100644 --- a/drivers/video/fbdev/core/fbsysfs.c +++ b/drivers/video/fbdev/core/fbsysfs.c @@ -91,9 +91,9 @@ static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var) var->activate |= FB_ACTIVATE_FORCE; console_lock(); - fb_info->flags |= FBINFO_MISC_USEREVENT; err = fb_set_var(fb_info, var); - fb_info->flags &= ~FBINFO_MISC_USEREVENT; + if (!err) + fbcon_update_vcs(fb_info, var->activate & FB_ACTIVATE_ALL); console_unlock(); if (err) return err; diff --git a/drivers/video/fbdev/ps3fb.c b/drivers/video/fbdev/ps3fb.c index 9df78fb77267..203c254f8f6c 100644 --- a/drivers/video/fbdev/ps3fb.c +++ b/drivers/video/fbdev/ps3fb.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include @@ -824,12 +825,12 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd, var = info->var; fb_videomode_to_var(&var, vmode); console_lock(); - info->flags |= FBINFO_MISC_USEREVENT; /* Force, in case only special bits changed */ var.activate |= FB_ACTIVATE_FORCE; par->new_mode_id = val; retval = fb_set_var(info, &var); - info->flags &= ~FBINFO_MISC_USEREVENT; + if (!retval) + fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL); console_unlock(); } break; diff --git a/include/linux/fb.h b/include/linux/fb.h index 2b530e6d86e4..850f79e9a7cb 100644 --- a/include/linux/fb.h +++ b/include/linux/fb.h @@ -400,8 +400,6 @@ struct fb_tile_ops { #define FBINFO_HWACCEL_YPAN 0x2000 /* optional */ #define FBINFO_HWACCEL_YWRAP 0x4000 /* optional */ -#define FBINFO_MISC_USEREVENT 0x10000 /* event request - from userspace */ #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */ /* A driver may set this flag to indicate that it does want a set_par to be From a34a0a632dd991a371fec56431d73279f9c54029 Mon Sep 17 00:00:00 2001 From: Xin Xiong Date: Sun, 19 Jul 2020 23:45:45 +0800 Subject: [PATCH 9/9] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit drm_dp_mst_allocate_vcpi() invokes drm_dp_mst_topology_get_port_validated(), which increases the refcount of the "port". These reference counting issues take place in two exception handling paths separately. Either when “slots” is less than 0 or when drm_dp_init_vcpi() returns a negative value, the function forgets to reduce the refcnt increased drm_dp_mst_topology_get_port_validated(), which results in a refcount leak. Fix these issues by pulling up the error handling when "slots" is less than 0, and calling drm_dp_mst_topology_put_port() before termination when drm_dp_init_vcpi() returns a negative value. Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi") Cc: # v4.12+ Signed-off-by: Xiyu Yang Signed-off-by: Xin Tan Signed-off-by: Xin Xiong Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine --- drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index 09b32289497e..b23cb2fec3f3 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -4308,11 +4308,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, { int ret; - port = drm_dp_mst_topology_get_port_validated(mgr, port); - if (!port) + if (slots < 0) return false; - if (slots < 0) + port = drm_dp_mst_topology_get_port_validated(mgr, port); + if (!port) return false; if (port->vcpi.vcpi > 0) { @@ -4328,6 +4328,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, if (ret) { DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n", DIV_ROUND_UP(pbn, mgr->pbn_div), ret); + drm_dp_mst_topology_put_port(port); goto out; } DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",