[PATCH 1/4] drm/i915: Don't leak edid in intel_crt_detect_ddc()

[PATCH 1/4] drm/i915: Don't leak edid in intel_crt_detect_ddc()

[Ander Conselvan de Oliveira]

In the path where intel_crt_detect_ddc() detects a CRT, if would return
true without freeing the edid.

Found by coverity.

Fixes: a2bd1f541f19 ("drm/i915: check whether we actually received an
edid in detect_ddc")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.6+
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
---
 drivers/gpu/drm/i915/intel_crt.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 385e29a..2bf5aca 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -499,6 +499,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
 	struct drm_i915_private *dev_priv = to_i915(crt->base.base.dev);
 	struct edid *edid;
 	struct i2c_adapter *i2c;
+	bool ret = false;
 
 	BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
 
@@ -515,17 +516,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
 		 */
 		if (!is_digital) {
 			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
-			return true;
+			ret = true;
+		} else {
+			DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
 		}
-
-		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
 	} else {
 		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
 	}
 
 	kfree(edid);
 
-	return false;
+	return ret;
 }
 
 static enum drm_connector_status
-- 
2.5.5

[PATCH 2/4] drm/i915: Don't init hpd polling for vlv and chv from runtime_suspend()

[Ander Conselvan de Oliveira]

An error in the condition for avoiding the call to intel_hpd_poll_init()
for valleyview and cherryview from intel_runtime_suspend() caused it to
be called unconditionally. Fix it.

Found by coverity.

Fixes: 19625e85c6ec ("drm/i915: Enable polling when we don't have hpd")
Cc: stable@vger.kernel.org
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Lyude <cpaul@redhat.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
---
 drivers/gpu/drm/i915/i915_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 4ae69eb..ca168b2 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -2377,7 +2377,7 @@ static int intel_runtime_suspend(struct device *kdev)
 
 	assert_forcewakes_inactive(dev_priv);
 
-	if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv))
+	if (!IS_VALLEYVIEW(dev_priv) && !IS_CHERRYVIEW(dev_priv))
 		intel_hpd_poll_init(dev_priv);
 
 	DRM_DEBUG_KMS("Device suspended\n");
-- 
2.5.5

[PATCH 3/4] drm/i915: Fix calculation of rotated x and y offsets for planar formats

[Ander Conselvan de Oliveira]

Parameters tile_size, tile_width and tile_height were passed in the
wrong order to _intel_adjust_tile_offset() when calculating the rotated
offsets.

This doesn't fix any user visible bug, since for packaged formats new
and old offset are the same and the rotated offsets are within a tile
before they are fed to _intel_adjust_tile_offset(). In that case, the
offsets are unchanged. That is not true for planar formats, but those
are currently not supported.

Found by coverity.

Fixes: 66a2d927cb0e ("drm/i915: Make intel_adjust_tile_offset() work for linear buffers")
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Sivakumar Thulasimani <sivakumar.thulasimani@intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
---
 drivers/gpu/drm/i915/intel_display.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index bddadd9..0759e8b 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2578,8 +2578,9 @@ intel_fill_fb_info(struct drm_i915_private *dev_priv,
 			 * We only keep the x/y offsets, so push all of the
 			 * gtt offset into the x/y offsets.
 			 */
-			_intel_adjust_tile_offset(&x, &y, tile_size,
-						  tile_width, tile_height, pitch_tiles,
+			_intel_adjust_tile_offset(&x, &y,
+						  tile_width, tile_height,
+						  tile_size, pitch_tiles,
 						  gtt_offset_rotated * tile_size, 0);
 
 			gtt_offset_rotated += rot_info->plane[i].width * rot_info->plane[i].height;
-- 
2.5.5

[PATCH 4/4] drm/i915: Check for NULL atomic state in intel_crtc_disable_noatomic()

[Ander Conselvan de Oliveira]

In intel_crtc_disable_noatomic(), bail on a failure to allocate an
atomic state to avoid a NULL pointer dereference.

Found by coverity.

Fixes: 4a80655827af ("drm/i915: Pass atomic state to crtc enable/disable functions")
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
---
 drivers/gpu/drm/i915/intel_display.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 0759e8b..38d5178 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6882,6 +6882,12 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
 	}
 
 	state = drm_atomic_state_alloc(crtc->dev);
+	if (!state) {
+		DRM_DEBUG_KMS("failed to disable [CRTC:%d:%s], out of memory",
+			      crtc->base.id, crtc->name);
+		return;
+	}
+
 	state->acquire_ctx = crtc->dev->mode_config.acquire_ctx;
 
 	/* Everything's already locked, -EDEADLK can't happen. */
-- 
2.5.5

Re: [PATCH 2/4] drm/i915: Don't init hpd polling for vlv and chv from runtime_suspend()

[Ville Syrjälä]

On Fri, Jan 20, 2017 at 04:28:43PM +0200, Ander Conselvan de Oliveira wrote:
> An error in the condition for avoiding the call to intel_hpd_poll_init()
> for valleyview and cherryview from intel_runtime_suspend() caused it to
> be called unconditionally. Fix it.
> 
> Found by coverity.
> 
> Fixes: 19625e85c6ec ("drm/i915: Enable polling when we don't have hpd")
> Cc: stable@vger.kernel.org
> Cc: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Lyude <cpaul@redhat.com>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: intel-gfx@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v4.9+
> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>

Reviewed-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>

> ---
>  drivers/gpu/drm/i915/i915_drv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
> index 4ae69eb..ca168b2 100644
> --- a/drivers/gpu/drm/i915/i915_drv.c
> +++ b/drivers/gpu/drm/i915/i915_drv.c
> @@ -2377,7 +2377,7 @@ static int intel_runtime_suspend(struct device *kdev)
>  
>  	assert_forcewakes_inactive(dev_priv);
>  
> -	if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv))
> +	if (!IS_VALLEYVIEW(dev_priv) && !IS_CHERRYVIEW(dev_priv))
>  		intel_hpd_poll_init(dev_priv);
>  
>  	DRM_DEBUG_KMS("Device suspended\n");
> -- 
> 2.5.5

-- 
Ville Syrj�l�
Intel OTC

Re: [PATCH 3/4] drm/i915: Fix calculation of rotated x and y offsets for planar formats

[Ville Syrjälä]

On Fri, Jan 20, 2017 at 04:28:44PM +0200, Ander Conselvan de Oliveira wrote:
> Parameters tile_size, tile_width and tile_height were passed in the
> wrong order to _intel_adjust_tile_offset() when calculating the rotated
> offsets.
> 
> This doesn't fix any user visible bug, since for packaged formats new
> and old offset are the same and the rotated offsets are within a tile
> before they are fed to _intel_adjust_tile_offset(). In that case, the
> offsets are unchanged. That is not true for planar formats, but those
> are currently not supported.
> 
> Found by coverity.
> 
> Fixes: 66a2d927cb0e ("drm/i915: Make intel_adjust_tile_offset() work for linear buffers")
> Cc: Ville Syrj�l� <ville.syrjala@linux.intel.com>
> Cc: Sivakumar Thulasimani <sivakumar.thulasimani@intel.com>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: intel-gfx@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v4.9+
> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>

Reviewed-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>

/me should really dig up whatever fb offset tests I had written earlier
and try to finish then...

> ---
>  drivers/gpu/drm/i915/intel_display.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> index bddadd9..0759e8b 100644
> --- a/drivers/gpu/drm/i915/intel_display.c
> +++ b/drivers/gpu/drm/i915/intel_display.c
> @@ -2578,8 +2578,9 @@ intel_fill_fb_info(struct drm_i915_private *dev_priv,
>  			 * We only keep the x/y offsets, so push all of the
>  			 * gtt offset into the x/y offsets.
>  			 */
> -			_intel_adjust_tile_offset(&x, &y, tile_size,
> -						  tile_width, tile_height, pitch_tiles,
> +			_intel_adjust_tile_offset(&x, &y,
> +						  tile_width, tile_height,
> +						  tile_size, pitch_tiles,
>  						  gtt_offset_rotated * tile_size, 0);
>  
>  			gtt_offset_rotated += rot_info->plane[i].width * rot_info->plane[i].height;
> -- 
> 2.5.5

-- 
Ville Syrj�l�
Intel OTC

Re: [Intel-gfx] [PATCH 4/4] drm/i915: Check for NULL atomic state in intel_crtc_disable_noatomic()

[Ville Syrjälä]

On Fri, Jan 20, 2017 at 04:28:45PM +0200, Ander Conselvan de Oliveira wrote:
> In intel_crtc_disable_noatomic(), bail on a failure to allocate an
> atomic state to avoid a NULL pointer dereference.
> 
> Found by coverity.
> 
> Fixes: 4a80655827af ("drm/i915: Pass atomic state to crtc enable/disable functions")
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: intel-gfx@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v4.9+
> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>

Reviewed-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>

> ---
>  drivers/gpu/drm/i915/intel_display.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
> index 0759e8b..38d5178 100644
> --- a/drivers/gpu/drm/i915/intel_display.c
> +++ b/drivers/gpu/drm/i915/intel_display.c
> @@ -6882,6 +6882,12 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
>  	}
>  
>  	state = drm_atomic_state_alloc(crtc->dev);
> +	if (!state) {
> +		DRM_DEBUG_KMS("failed to disable [CRTC:%d:%s], out of memory",
> +			      crtc->base.id, crtc->name);
> +		return;
> +	}
> +
>  	state->acquire_ctx = crtc->dev->mode_config.acquire_ctx;
>  
>  	/* Everything's already locked, -EDEADLK can't happen. */
> -- 
> 2.5.5
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Ville Syrj�l�
Intel OTC

Re: [Intel-gfx] [PATCH 1/4] drm/i915: Don't leak edid in intel_crt_detect_ddc()

[Ville Syrjälä]

On Fri, Jan 20, 2017 at 04:28:42PM +0200, Ander Conselvan de Oliveira wrote:
> In the path where intel_crt_detect_ddc() detects a CRT, if would return
> true without freeing the edid.
> 
> Found by coverity.
> 
> Fixes: a2bd1f541f19 ("drm/i915: check whether we actually received an
> edid in detect_ddc")
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: intel-gfx@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v3.6+
> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>

Reviewed-by: Ville Syrj�l� <ville.syrjala@linux.intel.com>

> ---
>  drivers/gpu/drm/i915/intel_crt.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
> index 385e29a..2bf5aca 100644
> --- a/drivers/gpu/drm/i915/intel_crt.c
> +++ b/drivers/gpu/drm/i915/intel_crt.c
> @@ -499,6 +499,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  	struct drm_i915_private *dev_priv = to_i915(crt->base.base.dev);
>  	struct edid *edid;
>  	struct i2c_adapter *i2c;
> +	bool ret = false;
>  
>  	BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
>  
> @@ -515,17 +516,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  		 */
>  		if (!is_digital) {
>  			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
> -			return true;
> +			ret = true;
> +		} else {
> +			DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  		}
> -
> -		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  	} else {
>  		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
>  	}
>  
>  	kfree(edid);
>  
> -	return false;
> +	return ret;
>  }
>  
>  static enum drm_connector_status
> -- 
> 2.5.5
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Ville Syrj�l�
Intel OTC

Re: [PATCH 1/4] drm/i915: Don't leak edid in intel_crt_detect_ddc()

[Jani Nikula]

On Fri, 20 Jan 2017, Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com> wrote:
> In the path where intel_crt_detect_ddc() detects a CRT, if would return
> true without freeing the edid.
>
> Found by coverity.
>
> Fixes: a2bd1f541f19 ("drm/i915: check whether we actually received an
> edid in detect_ddc")
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: intel-gfx@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v3.6+
> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>

Reviewed-by: Jani Nikula <jani.nikula@intel.com>

> ---
>  drivers/gpu/drm/i915/intel_crt.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
> index 385e29a..2bf5aca 100644
> --- a/drivers/gpu/drm/i915/intel_crt.c
> +++ b/drivers/gpu/drm/i915/intel_crt.c
> @@ -499,6 +499,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  	struct drm_i915_private *dev_priv = to_i915(crt->base.base.dev);
>  	struct edid *edid;
>  	struct i2c_adapter *i2c;
> +	bool ret = false;
>  
>  	BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
>  
> @@ -515,17 +516,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  		 */
>  		if (!is_digital) {
>  			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
> -			return true;
> +			ret = true;
> +		} else {
> +			DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  		}
> -
> -		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  	} else {
>  		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
>  	}
>  
>  	kfree(edid);
>  
> -	return false;
> +	return ret;
>  }
>  
>  static enum drm_connector_status

-- 
Jani Nikula, Intel Open Source Technology Center