Hey Linus, Turns out I was right, some fixes hadn't made it to me yet. The vmwgfx ones also popped up later, but all seem like bad enough things to fix. The dma-buf, vc4 and nouveau ones are all pretty small. The fbdev fixes are a bit more complicated, a fix to cleanup fbdev devices properly, uncovered some use-after-free bugs in existing drivers. Then the fix for those bugs wasn't correct. This reverts that fix, and puts the proper fixes in place in the drivers to avoid the use-after-frees. This has had a fair number of eyes on it at this stage, and I'm confident enough that it puts things in the right place, and is less dangerous than reverting our way out of the initial change at this stage. Let me know if you want more details, the commit msgs are quite verbose. Dave. drm-fixes-2022-05-14: drm fixes for 5.18-rc7 (part two) fbdev: - revert NULL deref fix that turned into a use-after-free - prevent use-after-free in fbdev - efifb/simplefb/vesafb: fix cleanup paths to avoid use-after-frees dma-buf: - fix panic in stats setup vc4: - fix hdmi build nouveau: - tegra iommu present fix - fix leak in backlight name vmwgfx: - Black screen due to fences using FIFO checks on SVGA3 - Random black screens on boot due to uninitialized drm_mode_fb_cmd2 - Hangs on SVGA3 due to command buffers being used with gbobjects The following changes since commit 5005e9814698f47c5a3698fcc56c9f5e6f1d4644: Merge tag 'amd-drm-fixes-5.18-2022-05-11' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes (2022-05-13 10:40:56 +1000) are available in the Git repository at: git://anongit.freedesktop.org/drm/drm tags/drm-fixes-2022-05-14 for you to fetch changes up to eb7bac3973d209e5227d1783676362ee5a8a7127: Merge tag 'drm-misc-fixes-2022-05-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes (2022-05-14 08:34:07 +1000) ---------------------------------------------------------------- drm fixes for 5.18-rc7 (part two) fbdev: - revert NULL deref fix that turned into a use-after-free - prevent use-after-free in fbdev - efifb/simplefb/vesafb: fix cleanup paths to avoid use-after-frees dma-buf: - fix panic in stats setup vc4: - fix hdmi build nouveau: - tegra iommu present fix - fix leak in backlight name vmwgfx: - Black screen due to fences using FIFO checks on SVGA3 - Random black screens on boot due to uninitialized drm_mode_fb_cmd2 - Hangs on SVGA3 due to command buffers being used with gbobjects ---------------------------------------------------------------- Charan Teja Reddy (1): dma-buf: call dma_buf_stats_setup after dmabuf is in valid list Christophe JAILLET (1): drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() Daniel Vetter (1): fbdev: Prevent possible use-after-free in fb_release() Dave Airlie (2): Merge tag 'vmwgfx-drm-fixes-5.18-2022-05-13' of https://gitlab.freedesktop.org/zack/vmwgfx into drm-fixes Merge tag 'drm-misc-fixes-2022-05-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Hui Tang (1): drm/vc4: hdmi: Fix build error for implicit function declaration Javier Martinez Canillas (5): Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered" fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove fbdev: efifb: Fix a use-after-free due early fb_info cleanup Maarten Lankhorst (1): Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes Robin Murphy (1): drm/nouveau/tegra: Stop using iommu_present() Zack Rusin (3): drm/vmwgfx: Fix fencing on SVGAv3 drm/vmwgfx: Initialize drm_mode_fb_cmd2 drm/vmwgfx: Disable command buffers on svga3 without gbobjects drivers/dma-buf/dma-buf.c | 8 +++---- drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 +++---- drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 13 ++++++---- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 8 +++++++ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 28 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 26 +++++++++++++------- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++++--- drivers/video/fbdev/core/fbmem.c | 5 +--- drivers/video/fbdev/core/fbsysfs.c | 4 ++++ drivers/video/fbdev/efifb.c | 9 ++++++- drivers/video/fbdev/simplefb.c | 8 ++++++- drivers/video/fbdev/vesafb.c | 8 ++++++- 15 files changed, 99 insertions(+), 40 deletions(-)
