From: Greg Kroah-Hartman Date: Sat, 27 Jan 2024 22:54:05 +0000 (-0800) Subject: 5.15-stable patches X-Git-Tag: v6.1.76~44 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eec8ad68418e90ba501e2f53250dbc0431521707;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch drm-tidss-fix-atomic_flush-check.patch --- diff --git a/queue-5.15/drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch b/queue-5.15/drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch new file mode 100644 index 00000000000..b88674c53bd --- /dev/null +++ b/queue-5.15/drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch @@ -0,0 +1,58 @@ +From 914437992876838662c968cb416f832110fb1093 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 4 Dec 2023 15:29:00 +0300 +Subject: drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking + +From: Dan Carpenter + +commit 914437992876838662c968cb416f832110fb1093 upstream. + +The i2c_master_send/recv() functions return negative error codes or the +number of bytes that were able to be sent/received. This code has +two problems. 1) Instead of checking if all the bytes were sent or +received, it checks that at least one byte was sent or received. +2) If there was a partial send/receive then we should return a negative +error code but this code returns success. + +Fixes: a9fe713d7d45 ("drm/bridge: Add PTN3460 bridge driver") +Cc: stable@vger.kernel.org +Signed-off-by: Dan Carpenter +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/0cdc2dce-ca89-451a-9774-1482ab2f4762@moroto.mountain +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/nxp-ptn3460.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/bridge/nxp-ptn3460.c ++++ b/drivers/gpu/drm/bridge/nxp-ptn3460.c +@@ -56,13 +56,13 @@ static int ptn3460_read_bytes(struct ptn + ret = i2c_master_send(ptn_bridge->client, &addr, 1); + if (ret <= 0) { + DRM_ERROR("Failed to send i2c command, ret=%d\n", ret); +- return ret; ++ return ret ?: -EIO; + } + + ret = i2c_master_recv(ptn_bridge->client, buf, len); +- if (ret <= 0) { ++ if (ret != len) { + DRM_ERROR("Failed to recv i2c data, ret=%d\n", ret); +- return ret; ++ return ret < 0 ? ret : -EIO; + } + + return 0; +@@ -78,9 +78,9 @@ static int ptn3460_write_byte(struct ptn + buf[1] = val; + + ret = i2c_master_send(ptn_bridge->client, buf, ARRAY_SIZE(buf)); +- if (ret <= 0) { ++ if (ret != ARRAY_SIZE(buf)) { + DRM_ERROR("Failed to send i2c command, ret=%d\n", ret); +- return ret; ++ return ret < 0 ? ret : -EIO; + } + + return 0; diff --git a/queue-5.15/drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch b/queue-5.15/drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch new file mode 100644 index 00000000000..b853b4195bc --- /dev/null +++ b/queue-5.15/drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch @@ -0,0 +1,48 @@ +From cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 11 Dec 2023 10:16:24 +0200 +Subject: drm: Don't unref the same fb many times by mistake due to deadlock handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c upstream. + +If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() +we proceed to unref the fb and then retry the whole thing from the top. +But we forget to reset the fb pointer back to NULL, and so if we then +get another error during the retry, before the fb lookup, we proceed +the unref the same fb again without having gotten another reference. +The end result is that the fb will (eventually) end up being freed +while it's still in use. + +Reset fb to NULL once we've unreffed it to avoid doing it again +until we've done another fb lookup. + +This turned out to be pretty easy to hit on a DG2 when doing async +flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I +saw that drm_closefb() simply got stuck in a busy loop while walking +the framebuffer list. Fortunately I was able to convince it to oops +instead, and from there it was easier to track down the culprit. + +Cc: stable@vger.kernel.org +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20231211081625.25704-1-ville.syrjala@linux.intel.com +Acked-by: Javier Martinez Canillas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_plane.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/drm_plane.c ++++ b/drivers/gpu/drm/drm_plane.c +@@ -1378,6 +1378,7 @@ retry: + out: + if (fb) + drm_framebuffer_put(fb); ++ fb = NULL; + if (plane->old_fb) + drm_framebuffer_put(plane->old_fb); + plane->old_fb = NULL; diff --git a/queue-5.15/drm-tidss-fix-atomic_flush-check.patch b/queue-5.15/drm-tidss-fix-atomic_flush-check.patch new file mode 100644 index 00000000000..b66d2bb28c4 --- /dev/null +++ b/queue-5.15/drm-tidss-fix-atomic_flush-check.patch @@ -0,0 +1,54 @@ +From 95d4b471953411854f9c80b568da7fcf753f3801 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 9 Nov 2023 09:38:03 +0200 +Subject: drm/tidss: Fix atomic_flush check + +From: Tomi Valkeinen + +commit 95d4b471953411854f9c80b568da7fcf753f3801 upstream. + +tidss_crtc_atomic_flush() checks if the crtc is enabled, and if not, +returns immediately as there's no reason to do any register changes. + +However, the code checks for 'crtc->state->enable', which does not +reflect the actual HW state. We should instead look at the +'crtc->state->active' flag. + +This causes the tidss_crtc_atomic_flush() to proceed with the flush even +if the active state is false, which then causes us to hit the +WARN_ON(!crtc->state->event) check. + +Fix this by checking the active flag, and while at it, fix the related +debug print which had "active" and "needs modeset" wrong way. + +Cc: +Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem") +Reviewed-by: Aradhya Bhatia +Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-10-ac91b5ea35c0@ideasonboard.com +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tidss/tidss_crtc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/tidss/tidss_crtc.c ++++ b/drivers/gpu/drm/tidss/tidss_crtc.c +@@ -172,13 +172,13 @@ static void tidss_crtc_atomic_flush(stru + struct tidss_device *tidss = to_tidss(ddev); + unsigned long flags; + +- dev_dbg(ddev->dev, +- "%s: %s enabled %d, needs modeset %d, event %p\n", __func__, +- crtc->name, drm_atomic_crtc_needs_modeset(crtc->state), +- crtc->state->enable, crtc->state->event); ++ dev_dbg(ddev->dev, "%s: %s is %sactive, %s modeset, event %p\n", ++ __func__, crtc->name, crtc->state->active ? "" : "not ", ++ drm_atomic_crtc_needs_modeset(crtc->state) ? "needs" : "doesn't need", ++ crtc->state->event); + + /* There is nothing to do if CRTC is not going to be enabled. */ +- if (!crtc->state->enable) ++ if (!crtc->state->active) + return; + + /* diff --git a/queue-5.15/series b/queue-5.15/series index 1e30be6a879..a0a8d18aab8 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -91,3 +91,6 @@ netfilter-nf_tables-reject-queue-drop-verdict-parameters.patch firmware-arm_scmi-check-mailbox-smt-channel-for-consistency.patch xfs-read-only-mounts-with-fsopen-mount-api-are-busted.patch gpiolib-acpi-ignore-touchpad-wakeup-on-gpd-g1619-04.patch +drm-don-t-unref-the-same-fb-many-times-by-mistake-due-to-deadlock-handling.patch +drm-bridge-nxp-ptn3460-fix-i2c_master_send-error-checking.patch +drm-tidss-fix-atomic_flush-check.patch