Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-29 07:31:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

A null pointer dereference fix for v3d and a protection fault fix for

Browse Source 
ttm.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRcEzekXsqa64kGDp7j7w1vZxhRxQUCZapnVgAKCRDj7w1vZxhR
 xStMAQDK8YH1S3cvNO6DEpge7tPc8NoUoDUd+O9ZefhL6+qT7gEAlNWcjSpxqTnX
 3NCLJbITAAvG58edL809JeW+JiBEUAA=
 =h3CM
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-fixes-2024-01-19' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

A null pointer dereference fix for v3d and a protection fault fix for
ttm.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/5zrphn2nhxnwillxlmo6ap3zh7qjt3jgydlm5sntuc4fzvwhpo@hznprx2bjyi7
This commit is contained in:
Dave Airlie 2024-01-25 14:19:52 +10:00
commit e5767a95ab
2 changed files with 35 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/gpu/drm/ttm/ttm_device.c
View File

@ -195,7 +195,7 @@ int ttm_device_init(struct ttm_device *bdev, const struct ttm_device_funcs *func
bool use_dma_alloc, bool use_dma32)
{
struct ttm_global *glob = &ttm_glob;
int ret;
int ret, nid;
if (WARN_ON(vma_manager == NULL))
return -EINVAL;
@ -215,7 +215,12 @@ int ttm_device_init(struct ttm_device *bdev, const struct ttm_device_funcs *func
ttm_sys_man_init(bdev);
ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32);
if (dev)
nid = dev_to_node(dev);
else
nid = NUMA_NO_NODE;
ttm_pool_init(&bdev->pool, dev, nid, use_dma_alloc, use_dma32);
bdev->vma_manager = vma_manager;
spin_lock_init(&bdev->lru_lock);

35
drivers/gpu/drm/v3d/v3d_submit.c
View File

@ -147,6 +147,13 @@ v3d_job_allocate(void **container, size_t size)
return 0;
}
static void
v3d_job_deallocate(void **container)
{
kfree(*container);
*container = NULL;
}
static int
v3d_job_init(struct v3d_dev *v3d, struct drm_file *file_priv,
struct v3d_job *job, void (*free)(struct kref *ref),
@ -273,8 +280,10 @@ v3d_setup_csd_jobs_and_bos(struct drm_file *file_priv,
ret = v3d_job_init(v3d, file_priv, &(*job)->base,
v3d_job_free, args->in_sync, se, V3D_CSD);
if (ret)
if (ret) {
v3d_job_deallocate((void *)job);
return ret;
}
ret = v3d_job_allocate((void *)clean_job, sizeof(**clean_job));
if (ret)
@ -282,8 +291,10 @@ v3d_setup_csd_jobs_and_bos(struct drm_file *file_priv,
ret = v3d_job_init(v3d, file_priv, *clean_job,
v3d_job_free, 0, NULL, V3D_CACHE_CLEAN);
if (ret)
if (ret) {
v3d_job_deallocate((void *)clean_job);
return ret;
}
(*job)->args = *args;
@ -860,8 +871,10 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
ret = v3d_job_init(v3d, file_priv, &render->base,
v3d_render_job_free, args->in_sync_rcl, &se, V3D_RENDER);
if (ret)
if (ret) {
v3d_job_deallocate((void *)&render);
goto fail;
}
render->start = args->rcl_start;
render->end = args->rcl_end;
@ -874,8 +887,10 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
ret = v3d_job_init(v3d, file_priv, &bin->base,
v3d_job_free, args->in_sync_bcl, &se, V3D_BIN);
if (ret)
if (ret) {
v3d_job_deallocate((void *)&bin);
goto fail;
}
bin->start = args->bcl_start;
bin->end = args->bcl_end;
@ -892,8 +907,10 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
ret = v3d_job_init(v3d, file_priv, clean_job,
v3d_job_free, 0, NULL, V3D_CACHE_CLEAN);
if (ret)
if (ret) {
v3d_job_deallocate((void *)&clean_job);
goto fail;
}
last_job = clean_job;
} else {
@ -1015,8 +1032,10 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
ret = v3d_job_init(v3d, file_priv, &job->base,
v3d_job_free, args->in_sync, &se, V3D_TFU);
if (ret)
if (ret) {
v3d_job_deallocate((void *)&job);
goto fail;
}
job->base.bo = kcalloc(ARRAY_SIZE(args->bo_handles),
sizeof(*job->base.bo), GFP_KERNEL);
@ -1233,8 +1252,10 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *data,
ret = v3d_job_init(v3d, file_priv, &cpu_job->base,
v3d_job_free, 0, &se, V3D_CPU);
if (ret)
if (ret) {
v3d_job_deallocate((void *)&cpu_job);
goto fail;
}
clean_job = cpu_job->indirect_csd.clean_job;
csd_job = cpu_job->indirect_csd.job;