drm/nv50: fix iommu errors caused by device reading from address 0

[safe/jmp/linux-2.6] / drivers / gpu / drm / drm_crtc.c

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6a472d5..57cea01 100644 (file)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -30,9 +30,11 @@
  *      Jesse Barnes <jesse.barnes@intel.com>
  */
 #include <linux/list.h>
+#include <linux/slab.h>
 #include "drm.h"
 #include "drmP.h"
 #include "drm_crtc.h"
+#include "drm_edid.h"
 
 struct drm_prop_enum_list {
        int type;
@@ -493,7 +495,6 @@ void drm_connector_cleanup(struct drm_connector *connector)
        list_for_each_entry_safe(mode, t, &connector->user_modes, head)
                drm_mode_remove(connector, mode);
 
-       kfree(connector->fb_helper_private);
        mutex_lock(&dev->mode_config.mutex);
        drm_mode_object_put(dev, &connector->base);
        list_del(&connector->head);
@@ -1839,8 +1840,10 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 
                ret = copy_from_user(clips, clips_ptr,
                                     num_clips * sizeof(*clips));
-               if (ret)
+               if (ret) {
+                       ret = -EFAULT;
                        goto out_err2;
+               }
        }
 
        if (fb->funcs->dirty) {
@@ -2348,7 +2351,7 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector,
                                            struct edid *edid)
 {
        struct drm_device *dev = connector->dev;
-       int ret = 0;
+       int ret = 0, size;
 
        if (connector->edid_blob_ptr)
                drm_property_destroy_blob(dev, connector->edid_blob_ptr);
@@ -2360,7 +2363,9 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector,
                return ret;
        }
 
-       connector->edid_blob_ptr = drm_property_create_blob(connector->dev, 128, edid);
+       size = EDID_LENGTH * (1 + edid->extensions);
+       connector->edid_blob_ptr = drm_property_create_blob(connector->dev,
+                                                           size, edid);
 
        ret = drm_connector_property_set_value(connector,
                                               dev->mode_config.edid_property,