--- /dev/null
+From bdf6f135973acb409b3ec5a6214fb597670a0bc0 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Thu, 12 Jan 2017 15:19:21 +0000
+Subject: drm/hisilicon/hibmc: Fix wrong pointer passed to PTR_ERR()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit bdf6f135973acb409b3ec5a6214fb597670a0bc0 upstream.
+
+PTR_ERR should access the value just tested by IS_ERR, otherwise
+the wrong error code will be returned.
+
+Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170112151921.16538-1-weiyj.lk@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -121,7 +121,7 @@ static int hibmc_drm_fb_create(struct dr
+
+ hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj);
+ if (IS_ERR(hi_fbdev->fb)) {
+- ret = PTR_ERR(info);
++ ret = PTR_ERR(hi_fbdev->fb);
+ DRM_ERROR("failed to initialize framebuffer: %d\n", ret);
+ goto out_release_fbi;
+ }
--- /dev/null
+From e89e50ac35d9126907a436dabe70f9a8311b9981 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 13 Dec 2016 15:23:32 +0300
+Subject: drm: mxsfb: drm_dev_alloc() returns error pointers
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e89e50ac35d9126907a436dabe70f9a8311b9981 upstream.
+
+We should be checking for IS_ERR() instead of NULL because
+drm_dev_alloc() returns error pointers.
+
+Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161213122332.GA7519@elgon.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mxsfb/mxsfb_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+@@ -395,8 +395,8 @@ static int mxsfb_probe(struct platform_d
+ pdev->id_entry = of_id->data;
+
+ drm = drm_dev_alloc(&mxsfb_driver, &pdev->dev);
+- if (!drm)
+- return -ENOMEM;
++ if (IS_ERR(drm))
++ return PTR_ERR(drm);
+
+ ret = mxsfb_load(drm, 0);
+ if (ret)
--- /dev/null
+From 3089c1df10e2931b1d72d2ffa7d86431084c86b3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= <nicolai.haehnle@amd.com>
+Date: Sat, 18 Feb 2017 22:59:56 +0100
+Subject: drm/ttm: fix use-after-free races in vm fault handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nicolai Hähnle <nicolai.haehnle@amd.com>
+
+commit 3089c1df10e2931b1d72d2ffa7d86431084c86b3 upstream.
+
+The vm fault handler relies on the fact that the VMA owns a reference
+to the BO. However, once mmap_sem is released, other tasks are free to
+destroy the VMA, which can lead to the BO being freed. Fix two code
+paths where that can happen, both related to vm fault retries.
+
+Found via a lock debugging warning which flagged &bo->wu_mutex as
+locked while being destroyed.
+
+Fixes: cbe12e74ee4e ("drm/ttm: Allow vm fault retries")
+Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_bo_vm.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -66,8 +66,11 @@ static int ttm_bo_vm_fault_idle(struct t
+ if (vmf->flags & FAULT_FLAG_RETRY_NOWAIT)
+ goto out_unlock;
+
++ ttm_bo_reference(bo);
+ up_read(&vma->vm_mm->mmap_sem);
+ (void) dma_fence_wait(bo->moving, true);
++ ttm_bo_unreserve(bo);
++ ttm_bo_unref(&bo);
+ goto out_unlock;
+ }
+
+@@ -120,8 +123,10 @@ static int ttm_bo_vm_fault(struct vm_are
+
+ if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
+ if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
++ ttm_bo_reference(bo);
+ up_read(&vma->vm_mm->mmap_sem);
+ (void) ttm_bo_wait_unreserved(bo);
++ ttm_bo_unref(&bo);
+ }
+
+ return VM_FAULT_RETRY;
+@@ -166,6 +171,13 @@ static int ttm_bo_vm_fault(struct vm_are
+ ret = ttm_bo_vm_fault_idle(bo, vma, vmf);
+ if (unlikely(ret != 0)) {
+ retval = ret;
++
++ if (retval == VM_FAULT_RETRY &&
++ !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
++ /* The BO has already been unreserved. */
++ return retval;
++ }
++
+ goto out_unlock;
+ }
+
openvswitch-set-internal-device-max-mtu-to-eth_max_mtu.patch
f2fs-sanity-check-segment-count.patch
xen-revert-commits-da72ff5bfcb0-and-72a9b186292d.patch
+drm-hisilicon-hibmc-fix-wrong-pointer-passed-to-ptr_err.patch
+drm-mxsfb-drm_dev_alloc-returns-error-pointers.patch
+drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
