drm/nv50: fix iommu errors caused by device reading from address 0

[safe/jmp/linux-2.6] / drivers / gpu / drm / drm_crtc.c

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index fa19c2b..57cea01 100644 (file)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -30,9 +30,11 @@
  *      Jesse Barnes <jesse.barnes@intel.com>
  */
 #include <linux/list.h>
+#include <linux/slab.h>
 #include "drm.h"
 #include "drmP.h"
 #include "drm_crtc.h"
+#include "drm_edid.h"
 
 struct drm_prop_enum_list {
        int type;
@@ -283,7 +285,7 @@ EXPORT_SYMBOL(drm_mode_object_find);
  * functions & device file and adds it to the master fd list.
  *
  * RETURNS:
- * Zero on success, error code on falure.
+ * Zero on success, error code on failure.
  */
 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
                         const struct drm_framebuffer_funcs *funcs)
@@ -493,7 +495,6 @@ void drm_connector_cleanup(struct drm_connector *connector)
        list_for_each_entry_safe(mode, t, &connector->user_modes, head)
                drm_mode_remove(connector, mode);
 
-       kfree(connector->fb_helper_private);
        mutex_lock(&dev->mode_config.mutex);
        drm_mode_object_put(dev, &connector->base);
        list_del(&connector->head);
@@ -857,7 +858,6 @@ void drm_mode_config_init(struct drm_device *dev)
        mutex_init(&dev->mode_config.mutex);
        mutex_init(&dev->mode_config.idr_mutex);
        INIT_LIST_HEAD(&dev->mode_config.fb_list);
-       INIT_LIST_HEAD(&dev->mode_config.fb_kernel_list);
        INIT_LIST_HEAD(&dev->mode_config.crtc_list);
        INIT_LIST_HEAD(&dev->mode_config.connector_list);
        INIT_LIST_HEAD(&dev->mode_config.encoder_list);
@@ -1840,8 +1840,10 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 
                ret = copy_from_user(clips, clips_ptr,
                                     num_clips * sizeof(*clips));
-               if (ret)
+               if (ret) {
+                       ret = -EFAULT;
                        goto out_err2;
+               }
        }
 
        if (fb->funcs->dirty) {
@@ -2349,7 +2351,7 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector,
                                            struct edid *edid)
 {
        struct drm_device *dev = connector->dev;
-       int ret = 0;
+       int ret = 0, size;
 
        if (connector->edid_blob_ptr)
                drm_property_destroy_blob(dev, connector->edid_blob_ptr);
@@ -2361,7 +2363,9 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector,
                return ret;
        }
 
-       connector->edid_blob_ptr = drm_property_create_blob(connector->dev, 128, edid);
+       size = EDID_LENGTH * (1 + edid->extensions);
+       connector->edid_blob_ptr = drm_property_create_blob(connector->dev,
+                                                           size, edid);
 
        ret = drm_connector_property_set_value(connector,
                                               dev->mode_config.edid_property,
@@ -2434,7 +2438,7 @@ int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
        } else if (connector->funcs->set_property)
                ret = connector->funcs->set_property(connector, property, out_resp->value);
 
-       /* store the property value if succesful */
+       /* store the property value if successful */
        if (!ret)
                drm_connector_property_set_value(connector, property, out_resp->value);
 out: