kernel.git/drivers/gpu/drm/arm/display, branch linux-5.17.y

drm/komeda: Fix an undefined behavior bug in komeda_plane_add()

2022-06-09T08:25:39Z

[ Upstream commit f5e284bb74ab296f98122673c7ecd22028b2c200 ] In komeda_plane_add(), komeda_get_layer_fourcc_list() is assigned to formats and used in drm_universal_plane_init(). drm_universal_plane_init() passes formats to __drm_universal_plane_init(). __drm_universal_plane_init() further passes formats to memcpy() as src parameter, which could lead to an undefined behavior bug on failure of komeda_get_layer_fourcc_list(). Fix this bug by adding a check of formats. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DRM_KOMEDA=m show no new warnings, and our static analyzer no longer warns about this code. Fixes: 61f1c4a8ab75 ("drm/komeda: Attach komeda_dev to DRM-KMS") Signed-off-by: Zhou Qingyang Signed-off-by: Liviu Dudau Link: https://lore.kernel.org/dri-devel/20211201033704.32054-1-zhou1615@umn.edu Signed-off-by: Sasha Levin

drm/komeda: return early if drm_universal_plane_init() fails.

2022-06-09T08:25:19Z

[ Upstream commit c8f76c37cc3668ee45e081e76a15f24a352ebbdd ] If drm_universal_plane_init() fails early we jump to the common cleanup code that calls komeda_plane_destroy() which in turn could access the uninitalised drm_plane and crash. Return early if an error is detected without going through the common code. Reported-by: Steven Price Reviewed-by: Steven Price Signed-off-by: Liviu Dudau Link: https://lore.kernel.org/dri-devel/20211203100946.2706922-1-liviu.dudau@arm.com Signed-off-by: Sasha Levin

drm: Remove CONFIG_DRM_KMS_CMA_HELPER option

2021-11-30T10:10:03Z

Link drm_fb_cma_helper.o into drm_cma_helper.ko if CONFIG_DRM_KMS_HELPER has been set. Remove CONFIG_DRM_KMS_CMA_HELPER config option. Selecting KMS helpers and CMA will now automatically enable CMA KMS helpers. Some drivers' Kconfig files did not correctly select KMS or CMA helpers. Fix this as part of the change. Signed-off-by: Thomas Zimmermann Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20211106193509.17472-3-tzimmermann@suse.de

drm/arm/komeda: Don't include drm_irq.h

2021-07-08T12:10:47Z

The header file is not required. Don't include it. Signed-off-by: Thomas Zimmermann Acked-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20210706072712.7558-1-tzimmermann@suse.de

drm/komeda: Don't set struct drm_device.irq_enabled

2021-06-29T09:08:42Z

The field drm_device.irq_enabled is only used by legacy drivers with userspace modesetting. Don't set it in komeda. Signed-off-by: Thomas Zimmermann Reviewed-by: Laurent Pinchart Acked-by: Liviu Dudau Acked-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210625082222.3845-8-tzimmermann@suse.de

drm/arm: Don't set allow_fb_modifiers explicitly

2021-05-05T19:26:08Z

Since commit 890880ddfdbe256083170866e49c87618b706ac7 Author: Paul Kocialkowski Date: Fri Jan 4 09:56:10 2019 +0100 drm: Auto-set allow_fb_modifiers when given modifiers at plane init this is done automatically as part of plane init, if drivers set the modifier list correctly. Which is the case here for both komeda and malidp. Acked-by: Liviu Dudau Reviewed-by: Lyude Paul Signed-off-by: Daniel Vetter Cc: "James (Qian) Wang" Cc: Liviu Dudau Cc: Mihail Atanassov Cc: Brian Starkey Link: https://patchwork.freedesktop.org/patch/msgid/20210427092018.832258-1-daniel.vetter@ffwll.ch

drm/komeda: Fix bit check to import to value of proper type

2021-04-01T12:48:48Z

Another issue found by KASAN. The bit finding is buried inside the dp_for_each_set_bit() macro (that passes on to for_each_set_bit() that calls the bit stuff. These bit functions want an unsigned long pointer as input and just dumbly casting leads to out-of-bounds accesses. This fixes that. Signed-off-by: Carsten Haitzler Reviewed-by: Steven Price Reviewed-by: James Qian Wang Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20210204131102.68658-1-carsten.haitzler@foss.arm.com

drm/komeda: Convert sysfs sprintf/snprintf family to sysfs_emit

2021-04-01T12:42:24Z

Fix the following coccicheck warning: drivers/gpu/drm/arm/display/komeda/komeda_dev.c:97:8-16: WARNING: use scnprintf or sprintf drivers/gpu/drm/arm/display/komeda/komeda_dev.c:88:8-16: WARNING: use scnprintf or sprintf drivers/gpu/drm/arm/display/komeda/komeda_dev.c:65:8-16: WARNING: use scnprintf or sprintf Signed-off-by: Tian Tao Reviewed-by: James Qian Wang Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/1617067518-31091-1-git-send-email-tiantao6@hisilicon.com

drm/atomic: Pass the full state to planes atomic disable and update

2021-02-25T07:05:28Z

The current atomic helpers have either their object state being passed as an argument or the full atomic state. The former is the pattern that was done at first, before switching to the latter for new hooks or when it was needed. Let's convert the remaining helpers to provide a consistent interface, this time with the planes atomic_update and atomic_disable. The conversion was done using the coccinelle script below, built tested on all the drivers. @@ identifier plane, plane_state; symbol state; @@ struct drm_plane_helper_funcs { ... void (*atomic_update)(struct drm_plane *plane, - struct drm_plane_state *plane_state); + struct drm_atomic_state *state); ... } @@ identifier plane, plane_state; symbol state; @@ struct drm_plane_helper_funcs { ... void (*atomic_disable)(struct drm_plane *plane, - struct drm_plane_state *plane_state); + struct drm_atomic_state *state); ... } @ plane_atomic_func @ identifier helpers; identifier func; @@ ( static const struct drm_plane_helper_funcs helpers = { ..., .atomic_update = func, ..., }; | static const struct drm_plane_helper_funcs helpers = { ..., .atomic_disable = func, ..., }; ) @@ struct drm_plane_helper_funcs *FUNCS; identifier f; identifier crtc_state; identifier plane, plane_state, state; expression e; @@ f(struct drm_crtc_state *crtc_state) { ... struct drm_atomic_state *state = e; <+... ( - FUNCS->atomic_disable(plane, plane_state) + FUNCS->atomic_disable(plane, state) | - FUNCS->atomic_update(plane, plane_state) + FUNCS->atomic_update(plane, state) ) ...+> } @@ identifier plane_atomic_func.func; identifier plane; symbol state; @@ func(struct drm_plane *plane, - struct drm_plane_state *state) + struct drm_plane_state *old_plane_state) { <... - state + old_plane_state ...> } @ ignores_old_state @ identifier plane_atomic_func.func; identifier plane, old_state; @@ func(struct drm_plane *plane, struct drm_plane_state *old_state) { ... when != old_state } @ adds_old_state depends on plane_atomic_func && !ignores_old_state @ identifier plane_atomic_func.func; identifier plane, plane_state; @@ func(struct drm_plane *plane, struct drm_plane_state *plane_state) { + struct drm_plane_state *plane_state = drm_atomic_get_old_plane_state(state, plane); ... } @ depends on plane_atomic_func @ identifier plane_atomic_func.func; identifier plane, plane_state; @@ func(struct drm_plane *plane, - struct drm_plane_state *plane_state + struct drm_atomic_state *state ) { ... } @ include depends on adds_old_state @ @@ #include @ no_include depends on !include && adds_old_state @ @@ + #include #include @@ identifier plane_atomic_func.func; identifier plane, state; identifier plane_state; @@ func(struct drm_plane *plane, struct drm_atomic_state *state) { ... struct drm_plane_state *plane_state = drm_atomic_get_old_plane_state(state, plane); <+... - plane_state->state + state ...+> } Reviewed-by: Laurent Pinchart Signed-off-by: Maxime Ripard Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210219120032.260676-9-maxime@cerno.tech

drm: Use the state pointer directly in planes atomic_check

2021-02-24T19:27:03Z

Now that atomic_check takes the global atomic state as a parameter, we don't need to go through the pointer in the plane state. This was done using the following coccinelle script: @ plane_atomic_func @ identifier helpers; identifier func; @@ static struct drm_plane_helper_funcs helpers = { ..., .atomic_check = func, ..., }; @@ identifier plane_atomic_func.func; identifier plane, state; identifier plane_state; @@ func(struct drm_plane *plane, struct drm_atomic_state *state) { ... - struct drm_plane_state *plane_state = drm_atomic_get_new_plane_state(state, plane); <... when != plane_state - plane_state->state + state ...> } @@ identifier plane_atomic_func.func; identifier plane, state; identifier plane_state; @@ func(struct drm_plane *plane, struct drm_atomic_state *state) { ... struct drm_plane_state *plane_state = drm_atomic_get_new_plane_state(state, plane); <... - plane_state->state + state ...> } Reviewed-by: Laurent Pinchart Signed-off-by: Maxime Ripard Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210219120032.260676-5-maxime@cerno.tech