[PATCH] drm: kirin: Fix missing clk_disable_unprepare in ade_power_up()
The clk_disable_unprepare() should be called in the error handling of
ade_power_up(). So as reset_control_assert().
Fixes: 783ad972c9a0 ("drm/hisilicon: Add crtc driver for ADE")
Signed-off-by: Shang XiaoJing
---
drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
index 871f79a6b17e..439e87923bcf 100644
--- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
+++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
@@ -229,12 +229,15 @@ static int ade_power_up(struct ade_hw_ctx *ctx)
ret = reset_control_deassert(ctx->reset);
if (ret) {
DRM_ERROR("failed to deassert reset\n");
+ clk_disable_unprepare(ctx->media_noc_clk);
return ret;
}
ret = clk_prepare_enable(ctx->ade_core_clk);
if (ret) {
DRM_ERROR("failed to enable ade_core_clk (%d)\n", ret);
+ reset_control_assert(ctx->reset);
+ clk_disable_unprepare(ctx->media_noc_clk);
return ret;
}
--
2.17.1
[PATCH] drm/nouveau: Fix missing pci_disable_device() in nouveau_pmops_runtime_resume()
Add missing pci_disable_device() in fail path of nouveau_do_resume().
Fixes: 7bb6d4428d3d ("drm/nouveau: move the (far too many...) different s/r
paths to the same place")
Signed-off-by: Shang XiaoJing
---
drivers/gpu/drm/nouveau/nouveau_drm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c
b/drivers/gpu/drm/nouveau/nouveau_drm.c
index fd99ec0f4257..d75cd21c1457 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -1068,6 +1068,7 @@ nouveau_pmops_runtime_resume(struct device *dev)
ret = nouveau_do_resume(drm_dev, true);
if (ret) {
NV_ERROR(drm, "resume failed with: %d\n", ret);
+ pci_disable_device(pdev);
return ret;
}
--
2.17.1
[PATCH] drm/vc4: vec: Use pm_runtime_resume_and_get() in vc4_vec_encoder_enable()
Commit f0601ef8631c ("drm/vc4: vec: Protect device resources after
removal") add fail path for vc4_vec_encoder_enable(), and will put
usage_counter only when pm_runtime_get_sync() succeeds. However,
pm_runtime_get_sync() will increment usage_counter even it failed. Fix
it by replacing it with pm_runtime_resume_and_get() to keep usage
counter balanced.
Fixes: e4b81f8c74c8 ("drm/vc4: Add support for the VEC (Video Encoder) IP")
Signed-off-by: Shang XiaoJing
---
drivers/gpu/drm/vc4/vc4_vec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_vec.c b/drivers/gpu/drm/vc4/vc4_vec.c
index 0b865702..f4e044ba09d4 100644
--- a/drivers/gpu/drm/vc4/vc4_vec.c
+++ b/drivers/gpu/drm/vc4/vc4_vec.c
@@ -367,7 +367,7 @@ static void vc4_vec_encoder_enable(struct drm_encoder
*encoder,
if (!drm_dev_enter(drm, &idx))
return;
- ret = pm_runtime_get_sync(&vec->pdev->dev);
+ ret = pm_runtime_resume_and_get(&vec->pdev->dev);
if (ret < 0) {
DRM_ERROR("Failed to retain power domain: %d\n", ret);
goto err_dev_exit;
--
2.17.1
[PATCH] drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
drmm_mode_config_init() will call drm_mode_create_standard_properties()
and won't check the ret value. When drm_mode_create_standard_properties()
failed due to alloc, property will be a NULL pointer and may causes the
null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.
Found null-ptr-deref while testing insert module bochs:
general protection fault, probably for non-canonical address
0xdc0c: [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0060-0x0067]
CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]
Call Trace:
__drm_connector_init+0xb6c/0x1100 [drm]
bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]
pci_device_probe+0x17d/0x340
really_probe+0x1db/0x5d0
__driver_probe_device+0x1e7/0x250
driver_probe_device+0x4a/0x120
__driver_attach+0xcd/0x2c0
bus_for_each_dev+0x11a/0x1b0
bus_add_driver+0x3d7/0x500
driver_register+0x18e/0x320
do_one_initcall+0xc4/0x3e0
do_init_module+0x1b4/0x630
load_module+0x5dca/0x7230
__do_sys_finit_module+0x100/0x170
do_syscall_64+0x3f/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff65af9f839
Fixes: 6b4959f43a04 ("drm/atomic: atomic plane properties")
Signed-off-by: Shang XiaoJing
---
drivers/gpu/drm/drm_mode_config.c | 8 +++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_mode_config.c
b/drivers/gpu/drm/drm_mode_config.c
index 939d621c9ad4..141a5b4042b2 100644
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -402,6 +402,8 @@ static void drm_mode_config_init_release(struct drm_device
*dev, void *ptr)
*/
int drmm_mode_config_init(struct drm_device *dev)
{
+ int ret;
+
mutex_init(&dev->mode_config.mutex);
drm_modeset_lock_init(&dev->mode_config.connection_mutex);
mutex_init(&dev->mode_config.idr_mutex);
@@ -423,7 +425,11 @@ int drmm_mode_config_init(struct drm_device *dev)
init_llist_head(&dev->mode_config.connector_free_list);
INIT_WORK(&dev->mode_config.connector_free_work,
drm_connector_free_work_fn);
- drm_mode_create_standard_properties(dev);
+ ret = drm_mode_create_standard_properties(dev);
+ if (ret) {
+ drm_mode_config_cleanup(dev);
+ return ret;
+ }
/* Just to be sure */
dev->mode_config.num_fb = 0;
--
2.17.1
[PATCH -next] fbdev: via: Fix section mismatch warning in via_core_init()
Due to viafb_exit() with "__exit" tag, it should not be called by the
__init function via_core_init().
WARNING: modpost: drivers/video/fbdev/via/viafb.o: section mismatch in
reference: init_module (section: .init.text) -> viafb_exit (section:
.exit.text)
Fixes: ab885d8c7e15 ("fbdev: via: Fix error in via_core_init()")
Signed-off-by: Shang XiaoJing
---
drivers/video/fbdev/via/via-core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/video/fbdev/via/via-core.c
b/drivers/video/fbdev/via/via-core.c
index b2e3b5df38cd..b8cd04defc5e 100644
--- a/drivers/video/fbdev/via/via-core.c
+++ b/drivers/video/fbdev/via/via-core.c
@@ -734,7 +734,6 @@ static int __init via_core_init(void)
if (ret) {
viafb_gpio_exit();
viafb_i2c_exit();
- viafb_exit();
return ret;
}
--
2.17.1
[PATCH] video: fbdev: via: Fix error in via_core_init()
via_core_init() won't exit the driver when pci_register_driver() failed.
Exit the viafb-i2c and the viafb-gpio in failed path to prevent error.
VIA Graphics Integration Chipset framebuffer 2.4 initializing
Error: Driver 'viafb-i2c' is already registered, aborting...
Error: Driver 'viafb-gpio' is already registered, aborting...
Fixes: 7582eb9be85f ("viafb: Turn GPIO and i2c into proper platform devices")
Signed-off-by: Shang XiaoJing
---
drivers/video/fbdev/via/via-core.c | 10 +-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/via/via-core.c
b/drivers/video/fbdev/via/via-core.c
index 2ee8fcae08df..b2e3b5df38cd 100644
--- a/drivers/video/fbdev/via/via-core.c
+++ b/drivers/video/fbdev/via/via-core.c
@@ -730,7 +730,15 @@ static int __init via_core_init(void)
return ret;
viafb_i2c_init();
viafb_gpio_init();
- return pci_register_driver(&via_driver);
+ ret = pci_register_driver(&via_driver);
+ if (ret) {
+ viafb_gpio_exit();
+ viafb_i2c_exit();
+ viafb_exit();
+ return ret;
+ }
+
+ return 0;
}
static void __exit via_core_exit(void)
--
2.17.1
[PATCH 1/2] drm/drv: Fix potential memory leak in drm_dev_init()
drm_dev_init() will add drm_dev_init_release() as a callback. When
drmm_add_action() failed, the release function won't be added. As the
result, the ref cnt added by device_get() in drm_dev_init() won't be put
by drm_dev_init_release(), which leads to the memleak. Use
drmm_add_action_or_reset() instead of drmm_add_action() to prevent
memleak.
unreferenced object 0x88810bc0c800 (size 2048):
comm "modprobe", pid 8322, jiffies 4305809845 (age 15.292s)
hex dump (first 32 bytes):
e8 cc c0 0b 81 88 ff ff ff ff ff ff 00 00 00 00
20 24 3c 0c 81 88 ff ff 18 c8 c0 0b 81 88 ff ff $<.
backtrace:
[<7251f72d>] __kmalloc+0x4b/0x1c0
[<45f21f26>] platform_device_alloc+0x2d/0xe0
[<4452a479>] platform_device_register_full+0x24/0x1c0
[<89f4ea61>] 0xa0736051
[<235b2441>] do_one_initcall+0x7a/0x380
[<01a4a177>] do_init_module+0x5c/0x230
[<2bf8a8e2>] load_module+0x227d/0x2420
[<637d6d0a>] __do_sys_finit_module+0xd5/0x140
[<c99fc324>] do_syscall_64+0x3f/0x90
[<4d85aa77>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: 2cbf7fc6718b ("drm: Use drmm_ for drm_dev_init cleanup")
Signed-off-by: Shang XiaoJing
---
drivers/gpu/drm/drm_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index e3a1243dd2ae..b2c2a5872621 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -616,7 +616,7 @@ static int drm_dev_init(struct drm_device *dev,
mutex_init(&dev->clientlist_mutex);
mutex_init(&dev->master_mutex);
- ret = drmm_add_action(dev, drm_dev_init_release, NULL);
+ ret = drmm_add_action_or_reset(dev, drm_dev_init_release, NULL);
if (ret)
return ret;
--
2.17.1
[PATCH 0/2] frm: Fix some bugs in drm
A memleak and a null-ptr-deref are found and fixed by this patch. Shang XiaoJing (2): drm/drv: Fix potential memory leak in drm_dev_init() drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_internal.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) -- 2.17.1
[PATCH 2/2] drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
drm_vblank_init() call drmm_add_action_or_reset() with
drm_vblank_init_release() as action. If __drmm_add_action() failed, will
directly call drm_vblank_init_release() with the vblank whose worker is
NULL. As the resule, a null-ptr-deref will happen in
kthread_destroy_worker(). Add the NULL check before calling
drm_vblank_destroy_worker().
BUG: null-ptr-deref
KASAN: null-ptr-deref in range [0x0068-0x006f]
CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty
RIP: 0010:kthread_destroy_worker+0x25/0xb0
Call Trace:
drm_vblank_init_release+0x124/0x220 [drm]
? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm]
__drmm_add_action_or_reset+0x41/0x50 [drm]
drm_vblank_init+0x282/0x310 [drm]
vkms_init+0x35f/0x1000 [vkms]
? 0xc4508000
? lock_is_held_type+0xd7/0x130
? __kmem_cache_alloc_node+0x1c2/0x2b0
? lock_is_held_type+0xd7/0x130
? 0xc4508000
do_one_initcall+0xd0/0x4f0
...
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Fixes: 5e6c2b4f9161 ("drm/vblank: Add vblank works")
Signed-off-by: Shang XiaoJing
---
drivers/gpu/drm/drm_internal.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h
index 7bb98e6a446d..5ea5e260118c 100644
--- a/drivers/gpu/drm/drm_internal.h
+++ b/drivers/gpu/drm/drm_internal.h
@@ -104,7 +104,8 @@ static inline void drm_vblank_flush_worker(struct
drm_vblank_crtc *vblank)
static inline void drm_vblank_destroy_worker(struct drm_vblank_crtc *vblank)
{
- kthread_destroy_worker(vblank->worker);
+ if (vblank->worker)
+ kthread_destroy_worker(vblank->worker);
}
int drm_vblank_worker_init(struct drm_vblank_crtc *vblank);
--
2.17.1
[PATCH -next] video: fbdev: imxfb: Remove redundant dev_err call
devm_ioremap_resource() prints error message in itself. Remove the
dev_err call to avoid redundant error message.
Signed-off-by: Shang XiaoJing
---
drivers/video/fbdev/imxfb.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index 94f3bc637fc8..51fde1b2a793 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -972,7 +972,6 @@ static int imxfb_probe(struct platform_device *pdev)
fbi->regs = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(fbi->regs)) {
- dev_err(&pdev->dev, "Cannot map frame buffer registers\n");
ret = PTR_ERR(fbi->regs);
goto failed_ioremap;
}
--
2.17.1
[PATCH -next] drm/mediatek: Remove redundant dev_err call
devm_ioremap_resource() prints error message in itself. Remove the
dev_err call to avoid redundant error message.
Signed-off-by: Shang XiaoJing
---
drivers/gpu/drm/mediatek/mtk_disp_aal.c | 4 +---
drivers/gpu/drm/mediatek/mtk_disp_merge.c | 4 +---
drivers/gpu/drm/mediatek/mtk_mdp_rdma.c | 4 +---
3 files changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_aal.c
b/drivers/gpu/drm/mediatek/mtk_disp_aal.c
index 0f9d7efb61d7..e72d5d8d77d8 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_aal.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_aal.c
@@ -118,10 +118,8 @@ static int mtk_disp_aal_probe(struct platform_device *pdev)
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
priv->regs = devm_ioremap_resource(dev, res);
- if (IS_ERR(priv->regs)) {
- dev_err(dev, "failed to ioremap aal\n");
+ if (IS_ERR(priv->regs))
return PTR_ERR(priv->regs);
- }
#if IS_REACHABLE(CONFIG_MTK_CMDQ)
ret = cmdq_dev_get_client_reg(dev, &priv->cmdq_reg, 0);
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_merge.c
b/drivers/gpu/drm/mediatek/mtk_disp_merge.c
index 6428b6203ffe..e096b6fb440c 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_merge.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_merge.c
@@ -252,10 +252,8 @@ static int mtk_disp_merge_probe(struct platform_device
*pdev)
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
priv->regs = devm_ioremap_resource(dev, res);
- if (IS_ERR(priv->regs)) {
- dev_err(dev, "failed to ioremap merge\n");
+ if (IS_ERR(priv->regs))
return PTR_ERR(priv->regs);
- }
priv->clk = devm_clk_get(dev, NULL);
if (IS_ERR(priv->clk)) {
diff --git a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
index eecfa98ff52e..d6be2b415f5a 100644
--- a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
+++ b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
@@ -263,10 +263,8 @@ static int mtk_mdp_rdma_probe(struct platform_device *pdev)
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
priv->regs = devm_ioremap_resource(dev, res);
- if (IS_ERR(priv->regs)) {
- dev_err(dev, "failed to ioremap rdma\n");
+ if (IS_ERR(priv->regs))
return PTR_ERR(priv->regs);
- }
priv->clk = devm_clk_get(dev, NULL);
if (IS_ERR(priv->clk)) {
--
2.17.1
