5.4-stable patches

added patches:
	drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch
	drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch

diff --git a/queue-5.4/drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch b/queue-5.4/drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch
new file mode 100644 (file)
index 0000000..b88674c
--- /dev/null
+++ b/queue-5.4/drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch
@@ -0,0 +1,58 @@
+From 914437992876838662c968cb416f832110fb1093 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Mon, 4 Dec 2023 15:29:00 +0300
+Subject: drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 914437992876838662c968cb416f832110fb1093 upstream.
+
+The i2c_master_send/recv() functions return negative error codes or the
+number of bytes that were able to be sent/received.  This code has
+two problems.  1)  Instead of checking if all the bytes were sent or
+received, it checks that at least one byte was sent or received.
+2) If there was a partial send/receive then we should return a negative
+error code but this code returns success.
+
+Fixes: a9fe713d7d45 ("drm/bridge: Add PTN3460 bridge driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/0cdc2dce-ca89-451a-9774-1482ab2f4762@moroto.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/nxp-ptn3460.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/nxp-ptn3460.c
++++ b/drivers/gpu/drm/bridge/nxp-ptn3460.c
+@@ -56,13 +56,13 @@ static int ptn3460_read_bytes(struct ptn
+       ret = i2c_master_send(ptn_bridge->client, &addr, 1);
+       if (ret <= 0) {
+               DRM_ERROR("Failed to send i2c command, ret=%d\n", ret);
+-              return ret;
++              return ret ?: -EIO;
+       }
+ 
+       ret = i2c_master_recv(ptn_bridge->client, buf, len);
+-      if (ret <= 0) {
++      if (ret != len) {
+               DRM_ERROR("Failed to recv i2c data, ret=%d\n", ret);
+-              return ret;
++              return ret < 0 ? ret : -EIO;
+       }
+ 
+       return 0;
+@@ -78,9 +78,9 @@ static int ptn3460_write_byte(struct ptn
+       buf[1] = val;
+ 
+       ret = i2c_master_send(ptn_bridge->client, buf, ARRAY_SIZE(buf));
+-      if (ret <= 0) {
++      if (ret != ARRAY_SIZE(buf)) {
+               DRM_ERROR("Failed to send i2c command, ret=%d\n", ret);
+-              return ret;
++              return ret < 0 ? ret : -EIO;
+       }
+ 
+       return 0;

diff --git a/queue-5.4/drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch b/queue-5.4/drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch
new file mode 100644 (file)
index 0000000..f90d004
--- /dev/null
+++ b/queue-5.4/drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch
@@ -0,0 +1,48 @@
+From cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 11 Dec 2023 10:16:24 +0200
+Subject: drm: Don't unref the same fb many times by mistake due to deadlock handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c upstream.
+
+If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl()
+we proceed to unref the fb and then retry the whole thing from the top.
+But we forget to reset the fb pointer back to NULL, and so if we then
+get another error during the retry, before the fb lookup, we proceed
+the unref the same fb again without having gotten another reference.
+The end result is that the fb will (eventually) end up being freed
+while it's still in use.
+
+Reset fb to NULL once we've unreffed it to avoid doing it again
+until we've done another fb lookup.
+
+This turned out to be pretty easy to hit on a DG2 when doing async
+flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I
+saw that drm_closefb() simply got stuck in a busy loop while walking
+the framebuffer list. Fortunately I was able to convince it to oops
+instead, and from there it was easier to track down the culprit.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231211081625.25704-1-ville.syrjala@linux.intel.com
+Acked-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_plane.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/drm_plane.c
++++ b/drivers/gpu/drm/drm_plane.c
+@@ -1203,6 +1203,7 @@ retry:
+ out:
+       if (fb)
+               drm_framebuffer_put(fb);
++      fb = NULL;
+       if (plane->old_fb)
+               drm_framebuffer_put(plane->old_fb);
+       plane->old_fb = NULL;

diff --git a/queue-5.4/series b/queue-5.4/series
index 57936db86b1475fc54256ddba8e321fdc3b767db..1971ea7fbfe5ba25add3ded53b4752b0a3cc12bd 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -48,3 +48,5 @@ btrfs-defrag-reject-unknown-flags-of-btrfs_ioctl_defrag_range_args.patch
 rbd-don-t-move-requests-to-the-running-list-on-errors.patch
 netfilter-nf_tables-reject-queue-drop-verdict-parameters.patch
 gpiolib-acpi-ignore-touchpad-wakeup-on-gpd-g1619-04.patch
+drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch
+drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch