- Fix a possible refcount leak in DP MST connector (Hangyu)

- Fix on loading guc on ADL-N (Daniele)
 - Fix vm use-after-free in vma destruction (Thomas)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmLG2uEACgkQ+mJfZA7r
 E8qcAQf+OlZLdQD9HFxSELQXK5gOeSyajYvh7UqCBUJGYZw496h/Jl7pxSkZ5SWI
 b+1ZC2gilKLeAB5K5duLB8Fu7MEaTnalv0Z7tnuu6GvmPtp7cYe+2H3k9aIm1OsW
 5iNV+uvi0jGp5dnLJJVINM/e2DLO8e3zIkib5TQiVcslDyop8d2nEKUWqbhvwhT0
 cUhLODsSMBMchIPJ62BVjh4j+l1pkz6Y8VsTaB8e1PSno39xDT9xNWarBnX+4k57
 HK7gmAl2SA9EcnbXv3GP2D3cJT6Cai7U9wVfvJNHXbvoWicOxtbH6NjGmVvkoix8
 Q8NO0NF+S3jfRgS068vpHCl8zrBJZw==
 =KTUi
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2022-07-07' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

- Fix a possible refcount leak in DP MST connector (Hangyu)
- Fix on loading guc on ADL-N (Daniele)
- Fix vm use-after-free in vma destruction (Thomas)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/YsbbgWnLTR8fr4lj@intel.com
This commit is contained in:
Dave Airlie 2022-07-12 10:40:24 +10:00
commit 42e0a87233
3 changed files with 18 additions and 4 deletions

View File

@ -839,6 +839,7 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs,
DRM_MODE_CONNECTOR_DisplayPort);
if (ret) {
drm_dp_mst_put_port_malloc(port);
intel_connector_free(intel_connector);
return NULL;
}

View File

@ -162,6 +162,15 @@ __uc_fw_auto_select(struct drm_i915_private *i915, struct intel_uc_fw *uc_fw)
u8 rev = INTEL_REVID(i915);
int i;
/*
* The only difference between the ADL GuC FWs is the HWConfig support.
* ADL-N does not support HWConfig, so we should use the same binary as
* ADL-S, otherwise the GuC might attempt to fetch a config table that
* does not exist.
*/
if (IS_ADLP_N(i915))
p = INTEL_ALDERLAKE_S;
GEM_BUG_ON(uc_fw->type >= ARRAY_SIZE(blobs_all));
fw_blobs = blobs_all[uc_fw->type].blobs;
fw_count = blobs_all[uc_fw->type].count;

View File

@ -1637,10 +1637,10 @@ static void force_unbind(struct i915_vma *vma)
GEM_BUG_ON(drm_mm_node_allocated(&vma->node));
}
static void release_references(struct i915_vma *vma, bool vm_ddestroy)
static void release_references(struct i915_vma *vma, struct intel_gt *gt,
bool vm_ddestroy)
{
struct drm_i915_gem_object *obj = vma->obj;
struct intel_gt *gt = vma->vm->gt;
GEM_BUG_ON(i915_vma_is_active(vma));
@ -1695,11 +1695,12 @@ void i915_vma_destroy_locked(struct i915_vma *vma)
force_unbind(vma);
list_del_init(&vma->vm_link);
release_references(vma, false);
release_references(vma, vma->vm->gt, false);
}
void i915_vma_destroy(struct i915_vma *vma)
{
struct intel_gt *gt;
bool vm_ddestroy;
mutex_lock(&vma->vm->mutex);
@ -1707,8 +1708,11 @@ void i915_vma_destroy(struct i915_vma *vma)
list_del_init(&vma->vm_link);
vm_ddestroy = vma->vm_ddestroy;
vma->vm_ddestroy = false;
/* vma->vm may be freed when releasing vma->vm->mutex. */
gt = vma->vm->gt;
mutex_unlock(&vma->vm->mutex);
release_references(vma, vm_ddestroy);
release_references(vma, gt, vm_ddestroy);
}
void i915_vma_parked(struct intel_gt *gt)