Merge tag 'drm-fixes-for-v4.10-final' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "Just two last minute fixes, one for DP MST oopses and one for a radeon
  regression"

* tag 'drm-fixes-for-v4.10-final' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: Use mode h/vdisplay fields to hide out of bounds HW cursor
  drm/dp/mst: fix kernel oops when turning off secondary monitor

2 files changed, 3 insertions, 3 deletions

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index aa644487749c..f59771da52ee 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1817,7 +1817,7 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
                                 mgr->payloads[i].vcpi = req_payload.vcpi;
                         } else if (mgr->payloads[i].num_slots) {
                                 mgr->payloads[i].num_slots = 0;
-                                drm_dp_destroy_payload_step1(mgr, port, port->vcpi.vcpi, &mgr->payloads[i]);
+                                drm_dp_destroy_payload_step1(mgr, port, mgr->payloads[i].vcpi, &mgr->payloads[i]);
                                 req_payload.payload_state = mgr->payloads[i].payload_state;
                                 mgr->payloads[i].start_slot = 0;
                         }
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index fb16070b266e..4a4f9533c53b 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -205,8 +205,8 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
         }
 
         if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) ||
-            x >= (crtc->x + crtc->mode.crtc_hdisplay) ||
-            y >= (crtc->y + crtc->mode.crtc_vdisplay))
+            x >= (crtc->x + crtc->mode.hdisplay) ||
+            y >= (crtc->y + crtc->mode.vdisplay))
                 goto out_of_bounds;
 
         x += xorigin;