mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-21 22:47:56 +00:00
b55efebb1f
Deleted (upstreamed): generic/backport-5.15/702-v5.19-32-net-ethernet-mtk_eth_soc-out-of-bounds-read-in-mtk_h.patch [01] [01] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.15.47&id=b24ca1cf846273361d5bd73a35de95a486a54b6d Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> [Removed 702-v5.19-32-net-ethernet-mtk_eth_soc-out-of-bounds-read-in-mtk_h.patch] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
122 lines
4.2 KiB
Diff
122 lines
4.2 KiB
Diff
From 41a635c959507290ba41afa56ac143d648a69958 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Vetter <daniel.vetter@ffwll.ch>
|
|
Date: Fri, 23 Oct 2020 14:39:23 +0200
|
|
Subject: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
The stuff never really worked, and leads to lots of fun because it
|
|
out-of-order frees atomic states. Which upsets KASAN, among other
|
|
things.
|
|
|
|
For async updates we now have a more solid solution with the
|
|
->atomic_async_check and ->atomic_async_commit hooks. Support for that
|
|
for msm and vc4 landed. nouveau and i915 have their own commit
|
|
routines, doing something similar.
|
|
|
|
For everyone else it's probably better to remove the use-after-free
|
|
bug, and encourage folks to use the async support instead. The
|
|
affected drivers which register a legacy cursor plane and don't either
|
|
use the new async stuff or their own commit routine are: amdgpu,
|
|
atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and vmwgfx.
|
|
|
|
Inspired by an amdgpu bug report.
|
|
|
|
v2: Drop RFC, I think with amdgpu converted over to use
|
|
atomic_async_check/commit done in
|
|
|
|
commit 674e78acae0dfb4beb56132e41cbae5b60f7d662
|
|
Author: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
|
|
Date: Wed Dec 5 14:59:07 2018 -0500
|
|
|
|
drm/amd/display: Add fast path for cursor plane updates
|
|
|
|
we don't have any driver anymore where we have userspace expecting
|
|
solid legacy cursor support _and_ they are using the atomic helpers in
|
|
their fully glory. So we can retire this.
|
|
|
|
v3: Paper over msm and i915 regression. The complete_all is the only
|
|
thing missing afaict.
|
|
|
|
v4: Rebased on recent kernel, added extra link for vc4 bug.
|
|
|
|
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199425
|
|
Link: https://lore.kernel.org/all/20220221134155.125447-9-maxime@cerno.tech/
|
|
Cc: mikita.lipski@amd.com
|
|
Cc: Michel Dänzer <michel@daenzer.net>
|
|
Cc: harry.wentland@amd.com
|
|
Cc: Rob Clark <robdclark@gmail.com>
|
|
Cc: "Kazlauskas, Nicholas" <nicholas.kazlauskas@amd.com>
|
|
Tested-by: Maxime Ripard <maxime@cerno.tech>
|
|
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
|
|
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
|
|
---
|
|
drivers/gpu/drm/drm_atomic_helper.c | 13 -------------
|
|
drivers/gpu/drm/i915/display/intel_display.c | 13 +++++++++++++
|
|
drivers/gpu/drm/msm/msm_atomic.c | 2 ++
|
|
3 files changed, 15 insertions(+), 13 deletions(-)
|
|
|
|
--- a/drivers/gpu/drm/drm_atomic_helper.c
|
|
+++ b/drivers/gpu/drm/drm_atomic_helper.c
|
|
@@ -1498,13 +1498,6 @@ drm_atomic_helper_wait_for_vblanks(struc
|
|
int i, ret;
|
|
unsigned int crtc_mask = 0;
|
|
|
|
- /*
|
|
- * Legacy cursor ioctls are completely unsynced, and userspace
|
|
- * relies on that (by doing tons of cursor updates).
|
|
- */
|
|
- if (old_state->legacy_cursor_update)
|
|
- return;
|
|
-
|
|
for_each_oldnew_crtc_in_state(old_state, crtc, old_crtc_state, new_crtc_state, i) {
|
|
if (!new_crtc_state->active)
|
|
continue;
|
|
@@ -2132,12 +2125,6 @@ int drm_atomic_helper_setup_commit(struc
|
|
complete_all(&commit->flip_done);
|
|
continue;
|
|
}
|
|
-
|
|
- /* Legacy cursor updates are fully unsynced. */
|
|
- if (state->legacy_cursor_update) {
|
|
- complete_all(&commit->flip_done);
|
|
- continue;
|
|
- }
|
|
|
|
if (!new_crtc_state->event) {
|
|
commit->event = kzalloc(sizeof(*commit->event),
|
|
--- a/drivers/gpu/drm/i915/display/intel_display.c
|
|
+++ b/drivers/gpu/drm/i915/display/intel_display.c
|
|
@@ -10821,6 +10821,19 @@ static int intel_atomic_commit(struct dr
|
|
state->base.legacy_cursor_update = false;
|
|
}
|
|
|
|
+ /*
|
|
+ * FIXME: Cut over to (async) commit helpers instead of hand-rolling
|
|
+ * everything.
|
|
+ */
|
|
+ if (state->base.legacy_cursor_update) {
|
|
+ struct intel_crtc_state *new_crtc_state;
|
|
+ struct intel_crtc *crtc;
|
|
+ int i;
|
|
+
|
|
+ for_each_new_intel_crtc_in_state(state, crtc, new_crtc_state, i)
|
|
+ complete_all(&new_crtc_state->uapi.commit->flip_done);
|
|
+ }
|
|
+
|
|
ret = intel_atomic_prepare_commit(state);
|
|
if (ret) {
|
|
drm_dbg_atomic(&dev_priv->drm,
|
|
--- a/drivers/gpu/drm/msm/msm_atomic.c
|
|
+++ b/drivers/gpu/drm/msm/msm_atomic.c
|
|
@@ -246,6 +246,8 @@ void msm_atomic_commit_tail(struct drm_a
|
|
/* async updates are limited to single-crtc updates: */
|
|
WARN_ON(crtc_mask != drm_crtc_mask(async_crtc));
|
|
|
|
+ complete_all(&async_crtc->state->commit->flip_done);
|
|
+
|
|
/*
|
|
* Start timer if we don't already have an update pending
|
|
* on this crtc:
|