From: Greg Kroah-Hartman Date: Sun, 7 Sep 2025 08:04:53 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.4.299~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=51fd166d886d20ec3517d8293cd90e193b0fecad;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-mediatek-add-crtc-path-enum-for-all_drm_priv-array.patch drm-mediatek-fix-device-node-reference-count-leaks-in-mtk_drm_get_all_drm_priv.patch drm-mediatek-fix-using-wrong-drm-private-data-to-bind-mediatek-drm.patch --- diff --git a/queue-6.6/drm-mediatek-add-crtc-path-enum-for-all_drm_priv-array.patch b/queue-6.6/drm-mediatek-add-crtc-path-enum-for-all_drm_priv-array.patch new file mode 100644 index 0000000000..866003169b --- /dev/null +++ b/queue-6.6/drm-mediatek-add-crtc-path-enum-for-all_drm_priv-array.patch @@ -0,0 +1,80 @@ +From stable+bounces-177525-greg=kroah.com@vger.kernel.org Tue Sep 2 19:12:02 2025 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:11:52 -0400 +Subject: drm/mediatek: Add crtc path enum for all_drm_priv array +To: stable@vger.kernel.org +Cc: "Jason-JH.Lin" , Fei Shao , CK Hu , AngeloGioacchino Del Regno , Chun-Kuang Hu , Sasha Levin +Message-ID: <20250902171154.1493908-1-sashal@kernel.org> + +From: "Jason-JH.Lin" + +[ Upstream commit 26c35d1d1646e593e3a82748b19d33b164871ae8 ] + +Add mtk_drm_crtc_path enum for each display path. + +Instead of using array index of all_drm_priv in mtk_drm_kms_init(), +mtk_drm_crtc_path enum can make code more readable. + +Signed-off-by: Jason-JH.Lin +Reviewed-by: Fei Shao +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Tested-by: Fei Shao +Link: https://patchwork.kernel.org/project/dri-devel/patch/20231004024013.18956-3-jason-jh.lin@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Stable-dep-of: 1f403699c40f ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +++--- + drivers/gpu/drm/mediatek/mtk_drm_drv.h | 8 +++++++- + 2 files changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -475,21 +475,21 @@ static int mtk_drm_kms_init(struct drm_d + for (j = 0; j < private->data->mmsys_dev_num; j++) { + priv_n = private->all_drm_private[j]; + +- if (i == 0 && priv_n->data->main_len) { ++ if (i == CRTC_MAIN && priv_n->data->main_len) { + ret = mtk_drm_crtc_create(drm, priv_n->data->main_path, + priv_n->data->main_len, j); + if (ret) + goto err_component_unbind; + + continue; +- } else if (i == 1 && priv_n->data->ext_len) { ++ } else if (i == CRTC_EXT && priv_n->data->ext_len) { + ret = mtk_drm_crtc_create(drm, priv_n->data->ext_path, + priv_n->data->ext_len, j); + if (ret) + goto err_component_unbind; + + continue; +- } else if (i == 2 && priv_n->data->third_len) { ++ } else if (i == CRTC_THIRD && priv_n->data->third_len) { + ret = mtk_drm_crtc_create(drm, priv_n->data->third_path, + priv_n->data->third_len, j); + if (ret) +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.h ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.h +@@ -9,11 +9,17 @@ + #include + #include "mtk_drm_ddp_comp.h" + +-#define MAX_CRTC 3 + #define MAX_CONNECTOR 2 + #define DDP_COMPONENT_DRM_OVL_ADAPTOR (DDP_COMPONENT_ID_MAX + 1) + #define DDP_COMPONENT_DRM_ID_MAX (DDP_COMPONENT_DRM_OVL_ADAPTOR + 1) + ++enum mtk_drm_crtc_path { ++ CRTC_MAIN, ++ CRTC_EXT, ++ CRTC_THIRD, ++ MAX_CRTC, ++}; ++ + struct device; + struct device_node; + struct drm_crtc; diff --git a/queue-6.6/drm-mediatek-fix-device-node-reference-count-leaks-in-mtk_drm_get_all_drm_priv.patch b/queue-6.6/drm-mediatek-fix-device-node-reference-count-leaks-in-mtk_drm_get_all_drm_priv.patch new file mode 100644 index 0000000000..a95c3423a2 --- /dev/null +++ b/queue-6.6/drm-mediatek-fix-device-node-reference-count-leaks-in-mtk_drm_get_all_drm_priv.patch @@ -0,0 +1,87 @@ +From stable+bounces-177527-greg=kroah.com@vger.kernel.org Tue Sep 2 19:12:05 2025 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:11:54 -0400 +Subject: drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv +To: stable@vger.kernel.org +Cc: Ma Ke , CK Hu , Chun-Kuang Hu , Sasha Levin +Message-ID: <20250902171154.1493908-3-sashal@kernel.org> + +From: Ma Ke + +[ Upstream commit 1f403699c40f0806a707a9a6eed3b8904224021a ] + +Using device_find_child() and of_find_device_by_node() to locate +devices could cause an imbalance in the device's reference count. +device_find_child() and of_find_device_by_node() both call +get_device() to increment the reference count of the found device +before returning the pointer. In mtk_drm_get_all_drm_priv(), these +references are never released through put_device(), resulting in +permanent reference count increments. Additionally, the +for_each_child_of_node() iterator fails to release node references in +all code paths. This leaks device node references when loop +termination occurs before reaching MAX_CRTC. These reference count +leaks may prevent device/node resources from being properly released +during driver unbind operations. + +As comment of device_find_child() says, 'NOTE: you will need to drop +the reference with put_device() after use'. + +Cc: stable@vger.kernel.org +Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support") +Signed-off-by: Ma Ke +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20250812071932.471730-1-make24@iscas.ac.cn/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -365,19 +365,19 @@ static bool mtk_drm_get_all_drm_priv(str + + of_id = of_match_node(mtk_drm_of_ids, node); + if (!of_id) +- continue; ++ goto next_put_node; + + pdev = of_find_device_by_node(node); + if (!pdev) +- continue; ++ goto next_put_node; + + drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match); + if (!drm_dev) +- continue; ++ goto next_put_device_pdev_dev; + + temp_drm_priv = dev_get_drvdata(drm_dev); + if (!temp_drm_priv) +- continue; ++ goto next_put_device_drm_dev; + + if (temp_drm_priv->data->main_len) + all_drm_priv[CRTC_MAIN] = temp_drm_priv; +@@ -389,10 +389,17 @@ static bool mtk_drm_get_all_drm_priv(str + if (temp_drm_priv->mtk_drm_bound) + cnt++; + +- if (cnt == MAX_CRTC) { +- of_node_put(node); ++next_put_device_drm_dev: ++ put_device(drm_dev); ++ ++next_put_device_pdev_dev: ++ put_device(&pdev->dev); ++ ++next_put_node: ++ of_node_put(node); ++ ++ if (cnt == MAX_CRTC) + break; +- } + } + + if (drm_priv->data->mmsys_dev_num == cnt) { diff --git a/queue-6.6/drm-mediatek-fix-using-wrong-drm-private-data-to-bind-mediatek-drm.patch b/queue-6.6/drm-mediatek-fix-using-wrong-drm-private-data-to-bind-mediatek-drm.patch new file mode 100644 index 0000000000..52d446b31e --- /dev/null +++ b/queue-6.6/drm-mediatek-fix-using-wrong-drm-private-data-to-bind-mediatek-drm.patch @@ -0,0 +1,76 @@ +From stable+bounces-177526-greg=kroah.com@vger.kernel.org Tue Sep 2 19:12:04 2025 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:11:53 -0400 +Subject: drm/mediatek: Fix using wrong drm private data to bind mediatek-drm +To: stable@vger.kernel.org +Cc: "Jason-JH.Lin" , AngeloGioacchino Del Regno , CK Hu , Fei Shao , Chun-Kuang Hu , Sasha Levin +Message-ID: <20250902171154.1493908-2-sashal@kernel.org> + +From: "Jason-JH.Lin" + +[ Upstream commit ebba0960993045787ca00bb0932d83dad98c2e26 ] + +According to mtk_drm_kms_init(), the all_drm_private array in each +drm private data stores all drm private data in display path order. + +In mtk_drm_get_all_drm_priv(), each element in all_drm_priv should have one +display path private data, such as: +all_drm_priv[CRTC_MAIN] should only have main_path data +all_drm_priv[CRTC_EXT] should only have ext_path data +all_drm_priv[CRTC_THIRD] should only have third_path data + +So we need to add the length checking for each display path before +assigning their drm private data into all_drm_priv array. + +Then the all_drm_private array in each drm private data needs to be +assigned in their display path order. + +Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support") +Signed-off-by: Jason-JH.Lin +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Tested-by: Fei Shao +Link: https://patchwork.kernel.org/project/dri-devel/patch/20231004024013.18956-4-jason-jh.lin@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Stable-dep-of: 1f403699c40f ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -352,6 +352,7 @@ static bool mtk_drm_get_all_drm_priv(str + { + struct mtk_drm_private *drm_priv = dev_get_drvdata(dev); + struct mtk_drm_private *all_drm_priv[MAX_CRTC]; ++ struct mtk_drm_private *temp_drm_priv; + struct device_node *phandle = dev->parent->of_node; + const struct of_device_id *of_id; + struct device_node *node; +@@ -371,11 +372,21 @@ static bool mtk_drm_get_all_drm_priv(str + continue; + + drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match); +- if (!drm_dev || !dev_get_drvdata(drm_dev)) ++ if (!drm_dev) + continue; + +- all_drm_priv[cnt] = dev_get_drvdata(drm_dev); +- if (all_drm_priv[cnt] && all_drm_priv[cnt]->mtk_drm_bound) ++ temp_drm_priv = dev_get_drvdata(drm_dev); ++ if (!temp_drm_priv) ++ continue; ++ ++ if (temp_drm_priv->data->main_len) ++ all_drm_priv[CRTC_MAIN] = temp_drm_priv; ++ else if (temp_drm_priv->data->ext_len) ++ all_drm_priv[CRTC_EXT] = temp_drm_priv; ++ else if (temp_drm_priv->data->third_len) ++ all_drm_priv[CRTC_THIRD] = temp_drm_priv; ++ ++ if (temp_drm_priv->mtk_drm_bound) + cnt++; + + if (cnt == MAX_CRTC) { diff --git a/queue-6.6/series b/queue-6.6/series index 0c2e7732dc..c9a606fc8b 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -90,3 +90,6 @@ dmaengine-mediatek-fix-a-possible-deadlock-error-in-mtk_cqdma_tx_status.patch net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-family.patch net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch vmxnet3-update-mtu-after-device-quiesce.patch +drm-mediatek-add-crtc-path-enum-for-all_drm_priv-array.patch +drm-mediatek-fix-using-wrong-drm-private-data-to-bind-mediatek-drm.patch +drm-mediatek-fix-device-node-reference-count-leaks-in-mtk_drm_get_all_drm_priv.patch