linux.git/drivers/gpu/drm/drm_gem_framebuffer_helper.c, branch v5.10.258

drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

2026-06-01T15:29:28+00:00

commit 3d4c2268bd7243c3780fe32bf24ff876da272acf upstream.

drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions
using plain integer division:

  unsigned int width  = mode_cmd->width  / (i ? info->hsub : 1);
  unsigned int height = mode_cmd->height / (i ? info->vsub : 1);

However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses
drm_format_info_plane_width/height() which round up dimensions via
DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object
size check for certain pixel format and dimension combinations.

For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the
GEM size validation path sees height=0 instead of height=1. The
expression (height - 1) then wraps to UINT_MAX as an unsigned int,
causing min_size to overflow and wrap back to a small value. A tiny
GEM object therefore passes the size guard, yet when the GPU accesses
the chroma plane it will read or write memory beyond the object's
bounds.

Fix by replacing the open-coded divisions with drm_format_info_plane_width()
and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match
the calculation already used in framebuffer_check().

Fixes: 4c3dbb2c312c ("drm: Add GEM backed framebuffer library")
Cc: stable@vger.kernel.org # v4.14+
Reviewed-by: Thomas Zimmermann 
Signed-off-by: Ashutosh Desai 
Signed-off-by: Thomas Zimmermann 
Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com
Signed-off-by: Greg Kroah-Hartman

drm: remove _unlocked suffix in drm_gem_object_put_unlocked

2020-05-19T21:31:31+00:00

Spelling out _unlocked for each and every driver is a annoying.
Especially if we consider how many drivers, do not know (or need to)
about the horror stories involving struct_mutex.

Just drop the suffix. It makes the API cleaner.

Done via the following script:

__from=drm_gem_object_put_unlocked
__to=drm_gem_object_put
for __file in $(git grep --name-only $__from); do
  sed -i  "s/$__from/$__to/g" $__file;
done

Pay special attention to the compat #define

v2: keep sed and #define removal separate

Cc: David Airlie 
Cc: Daniel Vetter 
Signed-off-by: Emil Velikov 
Acked-by: Sam Ravnborg  (v1)
Reviewed-by: Steven Price 
Acked-by: Thomas Zimmermann 
Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-14-emil.l.velikov@gmail.com

drm: Don't free a struct never allocated by drm_gem_fb_init()

2020-04-16T11:44:29+00:00

drm_gem_fb_init() is passed the fb and never allocates it, so it should be
not the one freeing it. As it is now the second call to kfree() is possible
with the same fb. Coverity reported the following:

*** CID 1492613:  Memory - corruptions  (USE_AFTER_FREE)
/drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
224     	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225     	if (!fb)
226     		return ERR_PTR(-ENOMEM);
227
228     	ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229     	if (ret) {
vvv     CID 1492613:  Memory - corruptions  (USE_AFTER_FREE)
vvv     Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230     		kfree(fb);
231     		return ERR_PTR(ret);
232     	}
233
234     	return fb;
235     }

drm_gem_fb_init_with_funcs() calls drm_gem_fb_init()
drm_gem_fb_init() calls kfree(fb)

Reported-by: coverity-bot 
Addresses-Coverity-ID: 1492613 ("Memory - corruptions")
Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Signed-off-by: Andrzej Pietrasiewicz 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200415172024.24004-1-andrzej.p@collabora.com

drm/core: Calculate bpp in afbc helper

2020-04-01T12:11:22+00:00

Some drivers (komeda, malidp) don't set anything in cpp. If that is the
case the right value can be inferred from the format. Then the "bpp" member
can be eliminated from struct drm_afbc_framebuffer.

Signed-off-by: Andrzej Pietrasiewicz 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200331155308.6345-3-andrzej.p@collabora.com

drm/core: Use proper debugging macro

2020-04-01T12:11:00+00:00

Use drm_dbg_kms() instead of DRM_DEBUG_KMS.

Signed-off-by: Andrzej Pietrasiewicz 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200331155308.6345-2-andrzej.p@collabora.com

drm/core: Add drm_afbc_framebuffer and a corresponding helper

2020-03-18T10:22:05+00:00

The new struct contains afbc-specific data.

The new function can be used by drivers which support afbc to complete
the preparation of struct drm_afbc_framebuffer. It must be called after
allocating the said struct and calling drm_gem_fb_init_with_funcs().

Signed-off-by: Andrzej Pietrasiewicz 
Reviewed-by: Emil Velikov 
Reviewed-by: James Qian Wang 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200311145541.29186-3-andrzej.p@collabora.com

drm/core: Allow drivers allocate a subclass of struct drm_framebuffer

2020-03-18T10:21:32+00:00

Allow allocating a specialized version of struct drm_framebuffer
by moving the actual fb allocation out of drm_gem_fb_create_with_funcs();
the respective functions names are adjusted to reflect that fact.
Please note, though, that standard size checks are performed on buffers,
so the drm_gem_fb_init_with_funcs() is useful for cases where those
standard size checks are appropriate or at least don't conflict the
checks to be performed in the specialized case.

Thanks to this change the drivers can call drm_gem_fb_init_with_funcs()
having allocated their special version of struct drm_framebuffer, exactly
the way the new version of drm_gem_fb_create_with_funcs() does.

Signed-off-by: Andrzej Pietrasiewicz 
Reviewed-by: Emil Velikov 
Reviewed-by: James Qian Wang 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200311145541.29186-2-andrzej.p@collabora.com

drm/gem-fb-helper: convert to drm device based logging

2019-12-19T13:55:10+00:00

Prefer drm_dbg_kms() and drm_err() over all other logging.

Reviewed-by: Sam Ravnborg 
Signed-off-by: Jani Nikula 
Link: https://patchwork.freedesktop.org/patch/msgid/20191210123050.8799-4-jani.nikula@intel.com

dma-buf: rename reservation_object to dma_resv

2019-08-13T07:09:30+00:00

Be more consistent with the naming of the other DMA-buf objects.

Signed-off-by: Christian König 
Reviewed-by: Chris Wilson 
Link: https://patchwork.freedesktop.org/patch/323401/

drm/fb: remove unused function: drm_gem_fbdev_fb_create()

2019-07-21T17:32:38+00:00

After migrating several drivers to the generic fbdev
emulation there are no users left of drm_gem_fbdev_fb_create.
Delete the function.

Noticed that there was no callers while browsing
around in the drm_fb* code.

The code that referenced the function was removed by:
commit 13aff184ed9f ("drm/qxl: remove dead qxl fbdev emulation code")

The actual use was removed by:
commit 26d4707d445d ("drm/qxl: use generic fbdev emulation")

v2:
- Updated changelog based on feedback from Noralf

Signed-off-by: Sam Ravnborg 
Reviewed-by: Noralf Trønnes 
Cc: Gerd Hoffmann 
Cc: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190721140610.GA20842@ravnborg.org