--- /dev/null
+From a79343dcaba4b11adb57350e0b6426906a9b658e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:15 +0200
+Subject: drm/msm/dp: fix IRQ lifetime
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit a79343dcaba4b11adb57350e0b6426906a9b658e upstream.
+
+Device-managed resources allocated post component bind must be tied to
+the lifetime of the aggregate DRM device or they will not necessarily be
+released when binding of the aggregate device is deferred.
+
+This is specifically true for the DP IRQ, which will otherwise remain
+requested so that the next bind attempt fails when requesting the IRQ a
+second time.
+
+Since commit c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus")
+this can happen when the aux-bus panel driver has not yet been loaded so
+that probe is deferred.
+
+Fix this by tying the device-managed lifetime of the DP IRQ to the DRM
+device so that it is released when bind fails.
+
+Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support")
+Cc: stable@vger.kernel.org # 5.10
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/502679/
+Link: https://lore.kernel.org/r/20220913085320.8577-6-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1201,7 +1201,7 @@ int dp_display_request_irq(struct msm_dp
+ return -EINVAL;
+ }
+
+- rc = devm_request_irq(&dp->pdev->dev, dp->irq,
++ rc = devm_request_irq(dp_display->drm_dev->dev, dp->irq,
+ dp_display_irq_handler,
+ IRQF_TRIGGER_HIGH, "dp_display_isr", dp);
+ if (rc < 0) {
--- /dev/null
+From 2e786eb2f9cebb07e317226b60054df510b60c65 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:13 +0200
+Subject: drm/msm/dsi: fix memory corruption with too many bridges
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream.
+
+Add the missing sanity check on the bridge counter to avoid corrupting
+data beyond the fixed-sized bridge array in case there are ever more
+than eight bridges.
+
+Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
+Cc: stable@vger.kernel.org # 4.1
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/502668/
+Link: https://lore.kernel.org/r/20220913085320.8577-4-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -205,6 +205,12 @@ int msm_dsi_modeset_init(struct msm_dsi
+ return -EINVAL;
+
+ priv = dev->dev_private;
++
++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
++ DRM_DEV_ERROR(dev->dev, "too many bridges\n");
++ return -ENOSPC;
++ }
++
+ msm_dsi->dev = dev;
+
+ ret = msm_dsi_host_modeset_init(msm_dsi->host, dev);
--- /dev/null
+From 4c1294da6aed1f16d47a417dcfe6602833c3c95c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:14 +0200
+Subject: drm/msm/hdmi: fix memory corruption with too many bridges
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream.
+
+Add the missing sanity check on the bridge counter to avoid corrupting
+data beyond the fixed-sized bridge array in case there are ever more
+than eight bridges.
+
+Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge")
+Cc: stable@vger.kernel.org # 3.12
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/502670/
+Link: https://lore.kernel.org/r/20220913085320.8577-5-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -293,6 +293,11 @@ int msm_hdmi_modeset_init(struct hdmi *h
+ struct platform_device *pdev = hdmi->pdev;
+ int ret;
+
++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
++ DRM_DEV_ERROR(dev->dev, "too many bridges\n");
++ return -ENOSPC;
++ }
++
+ hdmi->dev = dev;
+ hdmi->encoder = encoder;
+
exec-copy-oldsighand-action-under-spin-lock.patch
mac802154-fix-lqi-recording.patch
scsi-qla2xxx-use-transport-defined-speed-mask-for-supported_speeds.patch
+drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch
+drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch
+drm-msm-dp-fix-irq-lifetime.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
