Hi,
These patches fix two issues in the drm/drm_crtc driver. Initially I
was hitting the BUG_ON() in a scenario as explained in the commit
message of what is now the second patch in this series.
After posting, sashiko.dev noticed another issue, that was previously
masked by the now-removed BUG_ON(). Since we can't have a loud BUG() be
replaced with silent data corruption or worse, I've also added a patch
to address this issue highlighted by sashiko.dev. I believe its
observation and analysis to be correct.
Cheers,
Andre'
Signed-off-by: André Draszik <andre.draszik(a)linaro.org>
---
Changes in v3:
- Philipp:
- patch 1: update kerneldoc, add Fixes:
- patch 2: shorten commit message
- explicitly Cc: stable
- collect tag
- Link to v2: https://lore.kernel.org/r/20260708-linux-drm_crtc_fix2-v2-0-cf72be75d75a@li…
Changes in v2:
- add new patch 1 to address sashiko observation
- original patch 1 becomes patch 2
- patch 2:
- don't turn fence_to_crtc() into macro (Jani, Philipp)
- update commit message to include reference to deprecated use of BUG
- Link to v1: https://lore.kernel.org/r/20260618-linux-drm_crtc_fix2-v1-1-c03e77b36f34@li…
---
André Draszik (2):
drm/drm_crtc: ensure dma_fence_ops remain valid during device unbind
drm/drm_crtc: fix race with dma_fence_signal() in ::get_driver_name()
drivers/gpu/drm/drm_crtc.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
---
base-commit: 0718283ab28bc3907e10b61a6b4be6fefa1cbb2f
change-id: 20260618-linux-drm_crtc_fix2-23a7c354a412
Best regards,
--
André Draszik <andre.draszik(a)linaro.org>
On Fri, 31 Jul 2026 15:01:01 -0700 Bobby Eshleman wrote:
> Meanwhile, do we want drivers/net/hw/config to workaround by carrying
> something like SYNC_FILE or DMABUF_HEAPS, or wait and see about the
> udmabuf kconfig change?
Let's enable SYNC_FILE for now and pursue the UDMABUF change in
parallel. It will land in another tree if at all, so we'll have
to wait a while before it propagates to us.
On Wed, Jul 29, 2026 at 11:27 PM Baineng Shou <shoubaineng(a)gmail.com> wrote:
>
> Add a test case that verifies no file descriptor is leaked when
> DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails
> to deliver the fd number back to userspace.
>
> The failure is triggered by placing the ioctl argument in a private
> anonymous page and flipping it to PROT_READ (via mprotect) between
> the kernel's copy_from_user() and copy_to_user() calls. With the
> buggy kernel the ioctl returns -EFAULT but leaves an extra open fd
> in the process's fd table; with the fixed kernel the fd count is
> unchanged.
>
> This serves as a regression test for:
> "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds"
>
> Suggested-by: Sumit Semwal <sumit.semwal(a)linaro.org>
> Signed-off-by: Baineng Shou <shoubaineng(a)gmail.com>
> ---
> .../selftests/dmabuf-heaps/dmabuf-heap.c | 115 +++++++++++++++++-
> 1 file changed, 114 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c
> index fc9694fc4e89..bd58e5b06c8b 100644
> --- a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c
> +++ b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c
> @@ -390,6 +390,118 @@ static void test_alloc_errors(char *heap_name)
> close(heap_fd);
> }
>
> +/*
> + * test_alloc_no_fd_leak_on_efault - verify no fd is leaked when
> + * copy_to_user() fails during DMA_HEAP_IOCTL_ALLOC.
> + *
> + * The bug: dma_buf_fd() called fd_install() before copy_to_user().
> + * If copy_to_user() then failed (e.g. via mprotect), the fd was
> + * silently installed in the fd table but never returned to userspace.
> + *
> + * The fix: reserve the fd with get_unused_fd_flags() first, attempt
> + * copy_to_user(), and only call fd_install() on success.
> + *
> + * We trigger the failure by placing the ioctl argument in a page,
> + * flipping it to PROT_READ between copy_from_user and copy_to_user,
> + * and counting open file descriptors before and after.
> + */
> +static void test_alloc_no_fd_leak_on_efault(char *heap_name)
> +{
> + int heap_fd = -1;
> + int fd_before, fd_after;
> + int ret;
> + long page_size;
> + struct dma_heap_allocation_data *req;
> +
> + ksft_print_msg("Testing no fd leak when copy_to_user() fails:\n");
> +
> + heap_fd = dmabuf_heap_open(heap_name);
> +
> + page_size = sysconf(_SC_PAGESIZE);
> +
> + /*
> + * Place the ioctl argument in its own private anonymous page so
> + * we can flip its protection independently.
> + */
> + req = mmap(NULL, page_size, PROT_READ | PROT_WRITE,
> + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> + if (req == MAP_FAILED) {
> + ksft_test_result_fail("mmap failed: %s\n", strerror(errno));
> + goto out;
> + }
> +
> + memset(req, 0, sizeof(*req));
> + req->len = page_size;
> + req->fd_flags = O_RDWR | O_CLOEXEC;
> +
> + /* Count open fds before the ioctl */
> + fd_before = 0;
> + {
> + DIR *d = opendir("/proc/self/fd");
> + struct dirent *de;
> +
> + if (!d) {
> + ksft_test_result_fail("opendir /proc/self/fd: %s\n",
> + strerror(errno));
> + munmap(req, page_size);
> + goto out;
> + }
> + while ((de = readdir(d)))
> + if (de->d_name[0] != '.')
> + fd_before++;
> + closedir(d);
> + /* subtract the fd opened by opendir itself */
But no actual subtraction?
> + }
> +
> + /*
> + * Make the page read-only: copy_from_user() in the kernel will
> + * still succeed (it already ran),
Huh? copy_from_user hasn't run yet. That happens inside the ioctl().
> but copy_to_user() that writes
> + * the fd number back will fault.
> + */
> + mprotect(req, page_size, PROT_READ);
> +
> + ret = ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, req);
> +
> + /* Re-allow writes so munmap can clean up */
> + mprotect(req, page_size, PROT_READ | PROT_WRITE);
> + munmap(req, page_size);
> +
> + if (ret != -1 || errno != EFAULT) {
This looks like you meant &&, but I think we should just fail if ret
!= -1. Either the mprotect is broken, or dma-heap didn't actually try
to copy_to_user.
> + /*
> + * If the ioctl didn't fail with EFAULT, either the kernel
> + * handled it differently or mprotect raced.
mprotect is synchronous, how could it race with anything here?
> Skip rather
> + * than giving a false pass/fail.
> + */
> + ksft_test_result_skip(
> + "ioctl did not return EFAULT (ret=%d errno=%d), skipping\n",
> + ret, errno);
> + goto out;
> + }
> +
> + /* Count open fds after the failed ioctl */
> + fd_after = 0;
> + {
> + DIR *d = opendir("/proc/self/fd");
> + struct dirent *de;
> +
> + if (!d) {
> + ksft_test_result_fail("opendir /proc/self/fd: %s\n",
> + strerror(errno));
> + goto out;
> + }
> + while ((de = readdir(d)))
> + if (de->d_name[0] != '.')
> + fd_after++;
> + closedir(d);
> + }
> +
> + ksft_test_result(fd_before == fd_after,
> + "no fd leak on EFAULT: before=%d after=%d\n",
This is for the failure case, so I don't think the "no" should be in the string.
> + fd_before, fd_after);
> +out:
> + close(heap_fd);
> +}
> +
> static int numer_of_heaps(void)
> {
> DIR *d = opendir(DEVPATH);
> @@ -420,7 +532,7 @@ int main(void)
> return KSFT_SKIP;
> }
>
> - ksft_set_plan(11 * numer_of_heaps());
> + ksft_set_plan(12 * numer_of_heaps());
>
> while ((dir = readdir(d))) {
> if (!strncmp(dir->d_name, ".", 2))
> @@ -435,6 +547,7 @@ int main(void)
> test_alloc_zeroed(dir->d_name, ONE_MEG);
> test_alloc_compat(dir->d_name);
> test_alloc_errors(dir->d_name);
> + test_alloc_no_fd_leak_on_efault(dir->d_name);
> }
> closedir(d);
>
> --
> 2.34.1
>
On Thu, 30 Jul 2026 14:39:37 -0700 Bobby Eshleman wrote:
> Poking around, it looks like 231.1.167.0 and above should support
> everything, so fw should be okay AFAICT.
>
> Looks like the config is missing CONFIG_NET_DEVMEM and CONFIG_UDMABUF?
Ah, damn, you're right. I grepped for DEVMEM and didn't look closely on
a hit. Turns out there's a non-NET DEVMEM, too.
Could you send a patch to add the missing config options to
tools/testing/selftests/drivers/net/hw/config ?
Can be separate or part of this series, doesn't matter.
> Sorry, took me a while... was certain it was a bug in my code.
>
> Not the failure here, but wondering if this was on ARM led to seeing
> that 16K hardcoded rx_page_size in run_rx_large_niov() may fail on ARM
> with 64K pages because it will fail the IS_ALIGN(16K, 64K) check...
Ah, good thought. We've been meaning to get an ARM64 server for NIPA
(our current server supplier is out). If it's not too hard could be nice
to guard against that. But also not a huge deal for HW tests if they
fail instead of skipping.
+97158 994 3206} Abortion Pills in Dubai | Abu Dhabi | Sharjah
Whatsapp +97158 994 3206
We have Abortion Pills / Cytotec Tablets /mifegest kit Available in Dubai,
Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain,
UAE, buy cytotec in Dubai
+97158 994 3206 “”Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of
Misoprostol, Cytotec”
+97158 994 3206 Dr.Leen “BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE,
CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE” Contact me now via whatsapp……
abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain
Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be
very happy to do abortion in dubai
Buy abortion pills in Dubai Buy abortion pills in Oman Buy abortion pills
in Abu Dhabi Buy abortion pills in Sharjah Fujairah Buy abortion pills in
Ras Al Khaimah (RAK) Buy abortion pills in Ajman Buy abortion pills in Al
Ain Buy abortion pills in Umm Al Quwain (UAQ) Buy abortion pills in Kuwait
Abortion Pills Available In Dubai Abortion Pills Available In UAE Abortion
Pills Available In Abu Dhabi Abortion Pills Available In Sharjah Abortion
Pills Available In Fujairah Abortion Pills Available In Alain Abortion
Pills Available In Qatar Cytotec Available In Dubai Cytotec in Dubai Cyotec
Pills Dubai Abortion Cytotec Pills In Dubai whatsapp us at ?? +97158 994
3206 ?Buy abortion pills in Dubai, Buy abortion pills in Abudhabi, Buy
abortion pills in Sharja, Buy abortion pills in Abu az Zuluf, Buy abortion
pills in Ras Al Khaimah (RAK), Buy abortion pills in Ajman, Buy abortion
pills in Al Ain, abortion pills in DOHA, abortion pills in Abu Thaylah,
abortion pills in kuwait city, abortion pills in muscat, abortion pills in
jeddah,abortion pills in qatar,abortion pills in hawally,abortion pills in
salmiyah,abortion pills in al wakrah,abortion pills in riyadh,abortion
pills in manama,abortion pills in isa town,abortion pills in hamad town,
Buy abortion pills in Umm Al Quwain (UAQ), Buy abortion pills in Kuwait,
Abortion Pills Available In Dubai, Abortion Pills Available In UAE,
Abortion Pills Available In Abu Dhabi, Abortion Pills Available In Sharjah,
Abortion Pills Available In Fujairah, Abortion Pills Available In Alain,
Abortion Pills Available In Qatar, Cytotec Available In Dubai, Cytotec in
Dubai, Cytotec Pills Dubai, Abortion Cytotec Pills In Dubai UAE
we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication
abortion offers an alternative to Surgical Abortion for women in the early
weeks of pregnancy.
We only offer abortion pills from 1 week-6 Months.
We then advise you to use surgery if its beyond 6 months.
Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK),
Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides
the safest and most advanced techniques for providing non-surgical, medical
and surgical abortion methods for early through late second trimester,
including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone,
early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec
(Misoprostol).
The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day
Abortion Procedure using medications that are taken on the first day of the
office visit and will cause the abortion to occur generally within 4 to 6
hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant.
When Mifepristone and Misoprostol are used, 50% of patients complete in 4
to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen
that allows for completion without the need for surgery 99% of the time.
All advanced second trimester and late term pregnancies at our Tampa clinic
(17 to 24 weeks or greater) can be completed within 24 hours or less 99% of
the time without the need surgery. The procedure is completed with minimal
to no complications.
Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses
the latest medications for medical abortions (RU486, Mifeprex, Mifegyne,
Mifepristone, early options French abortion pill), Methotrexate and Cytotec
(Misoprostol).
The safety standards of our Abu Dhabi, United Arab Emirates Abortion
Doctors remain unparalleled. They consistently maintain the lowest
complication rates throughout the nation.
Our Physicians and staff are always available to answer questions and care
for women in one of the most difficult times in their lives.
The decision to have an abortion at the Abortion Clinic in Abu Dhabi,
United Arab Emirates, involves moral, ethical, religious, family,
financial, health and age considerations.
Buy abortion pills in Dubai,
Buy abortion pills in Oman,
Buy abortion pills in Abu Dhabi,
Buy abortion pills in Sharjah Fujairah,
Buy abortion pills in Ras Al Khaimah (RAK),
Buy abortion pills in Ajman,
Buy abortion pills in Al Ain,
Buy abortion pills in Umm Al Quwain (UAQ),
Buy abortion pills in Kuwait,
Abortion Pills Available In Dubai,
Abortion Pills Available In UAE,
Abortion Pills Available In Abu Dhabi,
Abortion Pills Available In Sharjah,
Abortion Pills Available In Fujairah,
Abortion Pills Available In Alain,
Abortion Pills Available In Qatar,
Cytotec Available In Dubai
Cytotec in Dubai,
abortion pills in Dubai for sale. +97158 994 3206
Cytotec Pills Dubai,
Abortion Cytotec Pills In Dubai UAE,
PRICE OF MIFE-KIT IN UAE
HOW TO GET ABORTION PILLS IN DUBAI
Safe Abortion in the UAE
MIFEPRISTONE IN UAE
MIFEPRISTONE IN DUBAI
LEVONORGESTRAL IN UAE
RU 486 IN DUBAI
RU 486 IN ABU DHABI
RU 486 IN UAE
ABORTION PILLS ONLINE DELIVERY IN DUBAI
ABORTION PILLS ON AMAZON IN UAE
SURGICAL ABORTION IN DUBAI
SURGICAL ABORTION IN ABU DHABI
Surgical Abortion in the UAE
COST OF SURGICAL ABORTION IN DUBAI/UAE
HOW MUCH IS SURGICAL ABORTION IN DUBAI
D & C IN DUBAI
COST OF D&C IN DUBAI/UAE/ABU DHABI
PRICE OF D & C PROCEDURE IN UAE
DILATION & CURETTAGE IN DUBAI/UAE
COST OF D & C IN DUBAI PRIVATE HOSPITAL
Whatsapp +97158 994 3206
Question Tags: +97158 994 3206 “Legit & Safe ABORTION PILLS, ABU DHABI
Sharjah Alain RAK city Satwa Jumeirah Al barsha, CYTOTEC, MIFEGEST KIT IN
DUBAI, Misoprostol, UAE” Contact me now via whatsapp…………. +97158 994 3206
On Fri, 24 Jul 2026 14:21:17 -0700 Bobby Eshleman wrote:
> From: Bobby Eshleman <bobbyeshleman(a)meta.com>
>
> Add a new devmem test case for binding the dmabuf with rx-page-size=16K.
> The test sweeps RX payload sizes straddling the niov boundary to cover
> the sub-niov, exact-niov, and multi-niov RX paths.
>
> Silence pylint invalid-name (`with open() as f`) and too-many-arguments
> (ncdevmem_rx grew to 6 args) at file scope.
>
> Signed-off-by: Bobby Eshleman <bobbyeshleman(a)meta.com>
> Acked-by: Stanislav Fomichev <sdf(a)fomichev.me>
Hm, odd. In NIPA we're getting:
TAP version 13
1..1
# timeout set to 0
# selftests: drivers/net/hw: devmem.py
# TAP version 13
# 1..5
# ok 1 devmem.check_rx # SKIP marked as disruptive
# ok 2 devmem.check_tx # SKIP marked as disruptive
# ok 3 devmem.check_tx_chunks # SKIP marked as disruptive
# ok 4 devmem.check_rx_hds # SKIP Test requires devmem support
# ok 5 devmem.check_rx_large_niov # SKIP Test requires devmem support
# # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:5 error:0
ok 1 selftests: drivers/net/hw: devmem.py
# Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0
https://netdev.bots.linux.dev/logs/hwksft/BCM57508/results/755681/config
driver: bnxt
fw: 237.1.148.0
Any idea?
On Fri, 24 Jul 2026 14:21:15 -0700 Bobby Eshleman wrote:
> + value: 0 # dummy: codegen needs a number, real value is the PAGE_SIZE macro (header)
yamllint says:
12:81 error line too long (89 > 80 characters) (line-length)