4.4-stable patches

added patches:
	drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch

diff --git a/queue-4.4/drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch b/queue-4.4/drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch
new file mode 100644 (file)
index 0000000..03b58ba
--- /dev/null
+++ b/queue-4.4/drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch
@@ -0,0 +1,55 @@
+From 7118fd9bd975a9f3093239d4c0f4e15356b57fab Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Fri, 18 Dec 2015 17:27:01 -0800
+Subject: drm/fb-helper: Use proper plane mask for fb cleanup
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+commit 7118fd9bd975a9f3093239d4c0f4e15356b57fab upstream.
+
+pan_display_atomic() calls drm_atomic_clean_old_fb() to sanitize the
+legacy FB fields (plane->fb and plane->old_fb).  However it was building
+the plane mask to pass to this function incorrectly (the bitwise OR was
+using plane indices rather than plane masks).  The end result was that
+sometimes the legacy pointers would become out of sync with the atomic
+pointers.  If another operation tried to re-set the same FB onto the
+plane, we might end up with the pointers back in sync, but improper
+reference counts, which would eventually lead to system crashes when we
+accessed a pointer to a prematurely-destroyed FB.
+
+The cause here was a very subtle bug introduced in commit:
+
+        commit 07d3bad6c1210bd21e85d084807ef4ee4ac43a78
+        Author: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+        Date:   Wed Nov 11 11:29:11 2015 +0100
+
+            drm/core: Fix old_fb handling in pan_display_atomic.
+
+I found the crashes were most easily reproduced (on i915 at least) by
+starting X and then VT switching to a VT that wasn't running a console
+instance...the sequence of vt/fbcon entries that happen in that case
+trigger a reference count mismatch and crash the system.
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93313
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Xuebing Chen <chenxb_99091@126.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1256,7 +1256,7 @@ retry:
+                       goto fail;
+ 
+               plane = mode_set->crtc->primary;
+-              plane_mask |= drm_plane_index(plane);
++              plane_mask |= (1 << drm_plane_index(plane));
+               plane->old_fb = plane->fb;
+       }
+ 

diff --git a/queue-4.4/series b/queue-4.4/series
index 5f8df05362bcf73f73989f41a23cd31a99b0058f..9061911357440e4478693fe4e59aaa77e8967bf9 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -37,3 +37,4 @@ bonding-fix-reference-count-leak-in-bond_sysfs_slave_add.patch
 revert-input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch
 netfilter-nf_conntrack_pptp-fix-compilation-warning-with-w-1-build.patch
 mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch
+drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch