From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 1 Jun 2020 16:48:23 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.4.226~18
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=da537013bfdc7b9a7cf19576344cd972e1e9a5e2;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch
---

diff --git a/queue-4.4/drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch b/queue-4.4/drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch
new file mode 100644
index 00000000000..03b58bad7a5
--- /dev/null
+++ b/queue-4.4/drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch
@@ -0,0 +1,55 @@
+From 7118fd9bd975a9f3093239d4c0f4e15356b57fab Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Fri, 18 Dec 2015 17:27:01 -0800
+Subject: drm/fb-helper: Use proper plane mask for fb cleanup
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+commit 7118fd9bd975a9f3093239d4c0f4e15356b57fab upstream.
+
+pan_display_atomic() calls drm_atomic_clean_old_fb() to sanitize the
+legacy FB fields (plane->fb and plane->old_fb).  However it was building
+the plane mask to pass to this function incorrectly (the bitwise OR was
+using plane indices rather than plane masks).  The end result was that
+sometimes the legacy pointers would become out of sync with the atomic
+pointers.  If another operation tried to re-set the same FB onto the
+plane, we might end up with the pointers back in sync, but improper
+reference counts, which would eventually lead to system crashes when we
+accessed a pointer to a prematurely-destroyed FB.
+
+The cause here was a very subtle bug introduced in commit:
+
+        commit 07d3bad6c1210bd21e85d084807ef4ee4ac43a78
+        Author: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+        Date:   Wed Nov 11 11:29:11 2015 +0100
+
+            drm/core: Fix old_fb handling in pan_display_atomic.
+
+I found the crashes were most easily reproduced (on i915 at least) by
+starting X and then VT switching to a VT that wasn't running a console
+instance...the sequence of vt/fbcon entries that happen in that case
+trigger a reference count mismatch and crash the system.
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93313
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Xuebing Chen <chenxb_99091@126.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1256,7 +1256,7 @@ retry:
+ 			goto fail;
+ 
+ 		plane = mode_set->crtc->primary;
+-		plane_mask |= drm_plane_index(plane);
++		plane_mask |= (1 << drm_plane_index(plane));
+ 		plane->old_fb = plane->fb;
+ 	}
+ 
diff --git a/queue-4.4/series b/queue-4.4/series
index 5f8df05362b..90619113574 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -37,3 +37,4 @@ bonding-fix-reference-count-leak-in-bond_sysfs_slave_add.patch
 revert-input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch
 netfilter-nf_conntrack_pptp-fix-compilation-warning-with-w-1-build.patch
 mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch
+drm-fb-helper-use-proper-plane-mask-for-fb-cleanup.patch