kernel/linux.git/drivers/gpu, branch v4.18.14

drm: fix use-after-free read in drm_mode_create_lease_ioctl()

2018-10-13T07:33:11+00:00

commit 12d43deb1ee639d01a2a8d2a7a4cc8ad31224475 upstream. fd_install() moves the reference given to it into the file descriptor table of the current process. If the current process is multithreaded, then immediately after fd_install(), another thread can close() the file descriptor and cause the file's resources to be cleaned up. Since the reference to "lessee" is held by the file, we must not access "lessee" after the fd_install() call. As far as I can tell, to reach this codepath, the caller must have an open file descriptor to a DRI device in master mode. I'm not sure what the requirements for that are. Signed-off-by: Jann Horn Fixes: 62884cd386b8 ("drm: Add four ioctls for managing drm mode object leases [v7]") Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181001153117.216923-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman

drm/syncobj: Don't leak fences when WAIT_FOR_SUBMIT is set

2018-10-13T07:33:11+00:00

commit 337fe9f5c1e7de1f391c6a692531379d2aa2ee11 upstream. We attempt to get fences earlier in the hopes that everything will already have fences and no callbacks will be needed. If we do succeed in getting a fence, getting one a second time will result in a duplicate ref with no unref. This is causing memory leaks in Vulkan applications that create a lot of fences; playing for a few hours can, apparently, bring down the system. Cc: stable@vger.kernel.org Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107899 Reviewed-by: Chris Wilson Signed-off-by: Jason Ekstrand Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20180926071703.15257-1-jason.ekstrand@intel.com Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: Fix vce work queue was not cancelled when suspend

2018-10-13T07:33:11+00:00

commit 61ea6f5831974ebd1a57baffd7cc30600a2e26fc upstream. The vce cancel_delayed_work_sync never be called. driver call the function in error path. This caused the A+A suspend hang when runtime pm enebled. As we will visit the smu in the idle queue. this will cause smu hang because the dgpu has been suspend, and the dgpu also will be waked up. As the smu has been hang, so the dgpu resume will failed. Reviewed-by: Christian König Reviewed-by: Feifei Xu Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

Revert "drm/amd/pp: Send khz clock values to DC for smu7/8"

2018-10-10T06:56:08+00:00

This reverts commit 93b100ddda3be284be160e9ccba28c7f8f21ab73 which was commit c3cb424a086921f6bb0449b10d998352a756d6d5 upstream. It was not needed for 4.18.y and caused problems there. Reported-by: Alexander Deucher Cc: Harry Wentland Cc: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk

2018-10-10T06:56:03+00:00

[ Upstream commit 0165de983272d1fae0809ed9db47c46a412279bc ] Slowly leaking memory one page at a time :) Signed-off-by: Christian König Reviewed-by: Andrey Grodzovsky Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/amdgpu: Fix SDMA hang in prt mode v2

2018-10-10T06:56:03+00:00

[ Upstream commit 68ebc13ea40656fddd3803735d621921a2d74a5e ] Fix SDMA hang in prt mode, clear XNACK_WATERMARK in reg SDMA0_UTCL1_WATERMK to avoid the issue Affected ASICs: VEGA10 VEGA12 RV1 RV2 v2: add reg clear for SDMA1 Signed-off-by: Tao Zhou Tested-by: Yukun Li Reviewed-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/nouveau/disp/gm200-: enforce identity-mapped SOR assignment for LVDS/eDP panels

2018-10-10T06:56:01+00:00

[ Upstream commit 53b0cc46f27cfc2cadca609b503a7d92b5185a47 ] Fixes eDP backlight issues on more recent laptops. Signed-off-by: Ben Skeggs Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/nouveau/disp: fix DP disable race

2018-10-10T06:56:01+00:00

[ Upstream commit e04cfdc9b7398c60dbc70212415ea63b6c6a93ae ] If a HPD pulse signalling the need to retrain the link occurs between the KMS driver releasing the output and the supervisor interrupt that finishes the teardown, it was possible get a NULL-ptr deref. Avoid this by marking the link as inactive earlier. Signed-off-by: Ben Skeggs Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS

2018-10-10T06:56:01+00:00

[ Upstream commit 0a6986c6595e9afd20ff7280dab36431c1e467f8 ] This Falcon application doesn't appear to be present on some newer systems, so let's not fail init if we can't find it. TBD: is there a way to determine whether it *should* be there? Signed-off-by: Ben Skeggs Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

drm/nouveau/mmu: don't attempt to dereference vmm without valid instance pointer

2018-10-10T06:56:01+00:00

[ Upstream commit 51ed833c881b9d96557c773f6a37018d79e29a46 ] Fixes oopses in certain failure paths. Signed-off-by: Ben Skeggs Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman