linux.git/drivers/gpu, branch v4.9.61

drm/exynos: g2d: prevent integer overflow in

2017-11-08T09:08:37+00:00

[ Upstream commit e41456bfc811f12b5dcda6f2d6849bdff68f6c0a ]

The size computations done in the ioctl function use an integer.
If userspace submits a request with req->cmd_nr or req->cmd_buf_nr
set to INT_MAX, the integer computations overflow later, leading
to potential (kernel) memory corruption.

Prevent this issue by enforcing a limit on the number of submitted
commands, so that we have enough headroom later for the size
computations.

Note that this change has no impact on the currently available
users in userspace, like e.g. libdrm/exynos.

While at it, also make a comment about the size computation more
detailed.

Signed-off-by: Joonyoung Shim 
Signed-off-by: Tobias Jakobi 
Signed-off-by: Inki Dae 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/fsl-dcu: check for clk_prepare_enable() error

2017-11-08T09:08:35+00:00

[ Upstream commit ef15d36154cc741d7ded4ae4fa0cf7987354e313 ]

clk_prepare_enable() may fail, so we should better check its return
value.

Also place the of_node_put() function right after clk_prepare_enable(),
in order to avoid calling of_node_put() twice in case clk_prepare_enable()
fails.

Signed-off-by: Fabio Estevam 
Signed-off-by: Stefan Agner 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: when dpm disabled, also need to stop/start vce.

2017-11-08T09:08:34+00:00

[ Upstream commit 28ed5504ab4b211a4e589e648e5ebd1e0caa7a6a ]

Signed-off-by: Rex Zhu 
Reviewed-by: Alex Deucher 
Acked-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

drm/msm: fix an integer overflow test

2017-11-08T09:08:32+00:00

commit 65e93108891e571f177c202add9288eda9ac4100 upstream.

We recently added an integer overflow check but it needs an additional
tweak to work properly on 32 bit systems.

The problem is that we're doing the right hand side of the assignment as
type unsigned long so the max it will have an integer overflow instead
of being larger than SIZE_MAX.  That means the "sz > SIZE_MAX" condition
is never true even on 32 bit systems.  We need to first cast it to u64
and then do the math.

Fixes: 4a630fadbb29 ("drm/msm: Fix potential buffer overflow issue")
Signed-off-by: Dan Carpenter 
Acked-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drm/msm: Fix potential buffer overflow issue

2017-11-08T09:08:32+00:00

commit 4a630fadbb29d9efaedb525f1a8f7449ad107641 upstream.

In function submit_create, if nr_cmds or nr_bos is assigned with
negative value, the allocated buffer may be small than intended.
Using this buffer will lead to buffer overflow issue.

Signed-off-by: Kasin Li 
Signed-off-by: Jordan Crouse 
Signed-off-by: Rob Clark 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

drm/i915/edp: read edp display control registers unconditionally

2017-11-08T09:08:32+00:00

commit 7c838e2a9be5ab79b11c7f1520813bfdf0f45462 upstream.

Per my reading of the eDP spec, DP_DPCD_DISPLAY_CONTROL_CAPABLE bit in
DP_EDP_CONFIGURATION_CAP should be set if the eDP display control
registers starting at offset DP_EDP_DPCD_REV are "enabled". Currently we
check the bit before reading the registers, and DP_EDP_DPCD_REV is the
only way to detect eDP revision.

Turns out there are (likely buggy) displays that require eDP 1.4+
features, such as supported link rates and link rate select, but do not
have the bit set. Read the display control registers
unconditionally. They are supposed to read zero anyway if they are not
supported, so there should be no harm in this.

This fixes the referenced bug by enabling the eDP version check, and
thus reading of the supported link rates. The panel in question has 0 in
DP_MAX_LINK_RATE which is only supported in eDP 1.4+. Without the
supported link rates method we default to RBR which is insufficient for
the panel native mode. As a curiosity, the panel also has a bogus value
of 0x12 in DP_EDP_DPCD_REV, but that passes our check for >= DP_EDP_14
(which is 0x03).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103400
Reported-and-tested-by: Nicolas P. 
Cc: Ville Syrjälä 
Reviewed-by: Ville Syrjälä 
Reviewed-by: Manasi Navare 
Signed-off-by: Jani Nikula 
Link: https://patchwork.freedesktop.org/patch/msgid/20171026142932.17737-1-jani.nikula@intel.com
(cherry picked from commit 0501a3b0eb01ac2209ef6fce76153e5d6b07034e)
Signed-off-by: Rodrigo Vivi 
Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: return -ENOENT from uvd 6.0 early init for harvesting

2017-11-08T09:08:32+00:00

commit cb4b02d7cac56a69d8137d8d843507cca9182aed upstream.

Fixes init failures on polaris cards with harvested UVD.

Signed-off-by: Leo Liu 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm/amd/powerplay: fix uninitialized variable

2017-11-02T08:49:14+00:00

commit 8b95f4f730cba02ef6febbdc4ca7e55ca045b00e upstream.

refresh_rate was not initialized when program
display gap.
this patch can fix vce ring test failed
when do S3 on Polaris10.

bug: https://bugs.freedesktop.org/show_bug.cgi?id=103102
bug: https://bugzilla.kernel.org/show_bug.cgi?id=196615
Reviewed-by: Alex Deucher 
Signed-off-by: Rex Zhu 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm/nouveau/mmu: flush tlbs before deleting page tables

2017-10-27T08:38:07+00:00

commit 77913bbcb43ac9a07a6fe849c2fd3bf85fc8bdd8 upstream.

Even though we've zeroed the PDE, the GPU may have cached the PD, so we
need to flush when deleting them.

Noticed while working on replacement MMU code, but a backport might be a
good idea, so let's fix it in the current code too.

Signed-off-by: Ben Skeggs 
Signed-off-by: Greg Kroah-Hartman

drm/nouveau/bsp/g92: disable by default

2017-10-27T08:38:07+00:00

commit 194d68dd051c2dd5ac2b522ae16100e774e8d869 upstream.

G92's seem to require some additional bit of initialization before the
BSP engine can work. It feels like clocks are not set up for the
underlying VLD engine, which means that all commands submitted to the
xtensa chip end up hanging. VP seems to work fine though.

This still allows people to force-enable the bsp engine if they want to
play around with it, but makes it harder for the card to hang by
default.

Signed-off-by: Ilia Mirkin 
Signed-off-by: Ben Skeggs 
Signed-off-by: Greg Kroah-Hartman