Patch "drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state" has been added to the 4.10-stable tree

Patch "drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state" has been added to the 4.10-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state

to the 4.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-nouveau-kms-nv50-fix-double-dma_fence_put-when-destroying-plane-state.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 2907e8670b6ef253bffb33bf47fd2182969cf2a0 Mon Sep 17 00:00:00 2001
From: Ben Skeggs <bskeggs@redhat.com>
Date: Wed, 5 Apr 2017 18:16:14 +1000
Subject: drm/nouveau/kms/nv50: fix double dma_fence_put() when destroying plane state

From: Ben Skeggs <bskeggs@redhat.com>

commit 2907e8670b6ef253bffb33bf47fd2182969cf2a0 upstream.

When the atomic support was added to nouveau, the DRM core did not do this.

However, later in the same merge window, a commit (drm/fence: add in-fences
support) was merged that added it, leading to use-after-frees of the fence
object.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/nouveau/nv50_display.c |    2 --
 1 file changed, 2 deletions(-)

--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -995,7 +995,6 @@ nv50_wndw_atomic_destroy_state(struct dr
 {
 	struct nv50_wndw_atom *asyw = nv50_wndw_atom(state);
 	__drm_atomic_helper_plane_destroy_state(&asyw->state);
-	dma_fence_put(asyw->state.fence);
 	kfree(asyw);
 }
 
@@ -1007,7 +1006,6 @@ nv50_wndw_atomic_duplicate_state(struct
 	if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL)))
 		return NULL;
 	__drm_atomic_helper_plane_duplicate_state(plane, &asyw->state);
-	asyw->state.fence = NULL;
 	asyw->interval = 1;
 	asyw->sema = armw->sema;
 	asyw->ntfy = armw->ntfy;


Patches currently in stable-queue which might be from bskeggs@redhat.com are

queue-4.10/drm-nouveau-mpeg-mthd-returns-true-on-success-now.patch
queue-4.10/drm-nouveau-mmu-nv4a-use-nv04-mmu-rather-than-the-nv44-one.patch
queue-4.10/drm-nouveau-kms-nv50-fix-setting-of-headsetrastervertblankdmi-method.patch
queue-4.10/drm-nouveau-kms-nv50-fix-double-dma_fence_put-when-destroying-plane-state.patch
queue-4.10/drm-nouveau-initial-support-display-only-for-gp107.patch