Skip to content

Commit

Permalink
Merge tag 'drm-misc-fixes-2019-06-19' of git://anongit.freedesktop.or…
Browse files Browse the repository at this point in the history
…g/drm/drm-misc into drm-fixes

panfrost- Only unmap BO's if they're mapped (Boris)
core- Handle buffer desc copy_to_user failure properly (Dan)

Cc: Boris Brezillon <boris.brezillon@collabora.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Sean Paul <sean@poorly.run>
Link: https://patchwork.freedesktop.org/patch/msgid/20190619192745.GA145841@art_vandelay
  • Loading branch information
Dave Airlie committed Jun 21, 2019
2 parents 47e3c4c + 74b67ef commit ea37e1a
Show file tree
Hide file tree
Showing 5 changed files with 19 additions and 3 deletions.
5 changes: 4 additions & 1 deletion drivers/gpu/drm/drm_bufs.c
Original file line number Diff line number Diff line change
Expand Up @@ -1340,7 +1340,10 @@ static int copy_one_buf(void *data, int count, struct drm_buf_entry *from)
.size = from->buf_size,
.low_mark = from->low_mark,
.high_mark = from->high_mark};
return copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags));

if (copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags)))
return -EFAULT;
return 0;
}

int drm_legacy_infobufs(struct drm_device *dev, void *data,
Expand Down
5 changes: 4 additions & 1 deletion drivers/gpu/drm/drm_ioc32.c
Original file line number Diff line number Diff line change
Expand Up @@ -375,7 +375,10 @@ static int copy_one_buf32(void *data, int count, struct drm_buf_entry *from)
.size = from->buf_size,
.low_mark = from->low_mark,
.high_mark = from->high_mark};
return copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags));

if (copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags)))
return -EFAULT;
return 0;
}

static int drm_legacy_infobufs32(struct drm_device *dev, void *data,
Expand Down
3 changes: 2 additions & 1 deletion drivers/gpu/drm/panfrost/panfrost_gem.c
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj)
struct panfrost_gem_object *bo = to_panfrost_bo(obj);
struct panfrost_device *pfdev = obj->dev->dev_private;

panfrost_mmu_unmap(bo);
if (bo->is_mapped)
panfrost_mmu_unmap(bo);

spin_lock(&pfdev->mm_lock);
drm_mm_remove_node(&bo->node);
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/panfrost/panfrost_gem.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ struct panfrost_gem_object {
struct drm_gem_shmem_object base;

struct drm_mm_node node;
bool is_mapped;
};

static inline
Expand Down
8 changes: 8 additions & 0 deletions drivers/gpu/drm/panfrost/panfrost_mmu.c
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,9 @@ int panfrost_mmu_map(struct panfrost_gem_object *bo)
struct sg_table *sgt;
int ret;

if (WARN_ON(bo->is_mapped))
return 0;

sgt = drm_gem_shmem_get_pages_sgt(obj);
if (WARN_ON(IS_ERR(sgt)))
return PTR_ERR(sgt);
Expand Down Expand Up @@ -189,6 +192,7 @@ int panfrost_mmu_map(struct panfrost_gem_object *bo)

pm_runtime_mark_last_busy(pfdev->dev);
pm_runtime_put_autosuspend(pfdev->dev);
bo->is_mapped = true;

return 0;
}
Expand All @@ -203,6 +207,9 @@ void panfrost_mmu_unmap(struct panfrost_gem_object *bo)
size_t unmapped_len = 0;
int ret;

if (WARN_ON(!bo->is_mapped))
return;

dev_dbg(pfdev->dev, "unmap: iova=%llx, len=%zx", iova, len);

ret = pm_runtime_get_sync(pfdev->dev);
Expand Down Expand Up @@ -230,6 +237,7 @@ void panfrost_mmu_unmap(struct panfrost_gem_object *bo)

pm_runtime_mark_last_busy(pfdev->dev);
pm_runtime_put_autosuspend(pfdev->dev);
bo->is_mapped = false;
}

static void mmu_tlb_inv_context_s1(void *cookie)
Expand Down

0 comments on commit ea37e1a

Please sign in to comment.