korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-24 20:54:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

Short summary of fixes pull (less than what git shortlog provides):

Browse Source 
* fbdev: Avoid use-after-free by not deleting current video mode
  * ttm: Avoid NULL-ptr deref in ttm_range_man_fini()
  * vmwgfx: Fix a merge commit
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmDv8eAACgkQaA3BHVML
 eiOjIwgAgN7WLhSA3FjdfxIsPCeEleeysc+gdIHEi2q5BOFQa3zmjB+D+a8efqsF
 pp5VTGvR2BH+v5qNnxKCRVvtit5zvcipIreB0k/dRBvCtZ/iDeDjxVlqvuNud7/9
 ZMCuUy4vv4VhcXxALoKo6ADRTITBWWGmtbkhgPRQT8kaT3v8M71x4TU9cH/oyn1Y
 DBRb514WnlgbuYtouWtYhR9GhPHj1dIL3XjklHaOeOUN+yOww5P43iT2UktMxY6e
 rJkMK9gNR9Tjhb9FpXQmArgCJbiZClu/ndy5P7EZcibskrUrOIbmdKFsfRshpGxI
 4GTW3aXbXbO9RHz2qg7v8YTrbX/YSw==
 =c9Dy
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2021-07-15' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Short summary of fixes pull (less than what git shortlog provides):

 * fbdev: Avoid use-after-free by not deleting current video mode
 * ttm: Avoid NULL-ptr deref in ttm_range_man_fini()
 * vmwgfx: Fix a merge commit

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/YO/yoFO+iSEqnIH0@linux-uq9g
This commit is contained in:
Dave Airlie 2021-07-16 09:51:41 +10:00
commit e1fc82a351
5 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/qxl/qxl_ttm.c
View File

@ -127,7 +127,7 @@ static void qxl_bo_move_notify(struct ttm_buffer_object *bo,
struct qxl_bo *qbo;
struct qxl_device *qdev;
if (!qxl_ttm_bo_is_qxl_bo(bo))
if (!qxl_ttm_bo_is_qxl_bo(bo) || !bo->resource)
return;
qbo = to_qxl_bo(bo);
qdev = to_qxl(qbo->tbo.base.dev);

3
drivers/gpu/drm/ttm/ttm_range_manager.c
View File

@ -181,6 +181,9 @@ int ttm_range_man_fini(struct ttm_device *bdev,
struct drm_mm *mm = &rman->mm;
int ret;
if (!man)
return 0;
ttm_resource_manager_set_used(man, false);
ret = ttm_resource_manager_evict_all(bdev, man);

1
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
View File

@ -36,6 +36,7 @@
#include <drm/drm_ioctl.h>
#include <drm/drm_sysfs.h>
#include <drm/ttm/ttm_bo_driver.h>
#include <drm/ttm/ttm_range_manager.h>
#include <drm/ttm/ttm_placement.h>
#include <generated/utsrelease.h>

1
drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
View File

@ -354,7 +354,6 @@ static void vmw_otable_batch_takedown(struct vmw_private *dev_priv,
ttm_bo_unpin(bo);
ttm_bo_unreserve(bo);
ttm_bo_unpin(batch->otable_bo);
ttm_bo_put(batch->otable_bo);
batch->otable_bo = NULL;
}

12
drivers/video/fbdev/core/fbmem.c
View File

@ -970,13 +970,11 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
fb_var_to_videomode(&mode2, &info->var);
/* make sure we don't delete the videomode of current var */
ret = fb_mode_is_equal(&mode1, &mode2);
if (!ret)
fbcon_mode_deleted(info, &mode1);
if (!ret)
fb_delete_videomode(&mode1, &info->modelist);
if (!ret) {
ret = fbcon_mode_deleted(info, &mode1);
if (!ret)
fb_delete_videomode(&mode1, &info->modelist);
}
return ret ? -EINVAL : 0;
}